Information technologies/NBIC and Big data Principles at stake – Action(s) to be undertaken at intergovernmental level to address the identified challenges Alessandra Pierucci Chair of the Committee of Convention 108 24-25 October 2017

Setting the scene - Data Protection legal framework The Universal Declaration of Human Rights takes as its starting point the inviolability of human dignity + Right to Privacy (article 12) European Convention on Human Rights: Right to private life (article 8) Prohibition of discrimination (article 14) European Charter of Fundamental rights - Dignity (article 1) Right to private life (article 7) Right to the protection of personal data (article 8) Non discrimination (article 21)

Oviedo Convention and Convention 108/1981 Oviedo Convention and Convention 108 “speak the same language”. Dignity, identity, non-discrimination, integrity of the individual Transparency, informed and free consent

Data protection standards Convention 108 - Sole legally binding international instrument 51 Parties: 47 member states of the COE plus Mauritius, Senegal Tunisia, Uruguay  Pending: Argentina, Burkina Faso, Cabo Verde, Morocco invited to accede Mexico: currently being considered 

Convention 108/1981: (some) new elements of the modernised version New definition on sensitive data (article 6) which now explicitly include genetic data and biometric data Additional obligations (Article 8bis) for data controllers (Accountability, Data Protection Impact Assessment, Privacy by design) Strengthened data subject’s rights (not to be subject to automated decisions; to obtain knowledge of the reasoning underlying data processing)

Guidelines on Big Data (1) Big Data as a new paradigm in the way in which information is collected and analysed Big data can be a source of significant value and innovation Not all data processed in a big data context concern personal data and human interaction but a large spectrum of it does, with a direct impact on individuals Legal, social and ethical implications of the use of Big Data for decision-making processes + marginalisation of an effective and informed involvement by individuals in these processes Need for a broader idea of control over the use of data, not limited to individual control (more complex process of multiple-impact assessment of the risks)  Need to adapt traditional principles of data processing (data minimisation, purpose limitation, fairness and transparency, and free, specific and informed consent) to the new technological scenario

Guidelines on big data (2) General guidance – to be complemented in sector-specific applications, e.g. Health data Promoting an ethical and socially aware use of data (e.g. impact assessment, ethical committees) Preventive policies and risk assessment (DPimpact assessment, privacy by design, accountability) Purpose limitation and transparency(compatibility of purpose) Consent (free consent, burden of proof on data controller) Anonymisation (assessment of the risk of re-identification) Role of the human intervention in Big Data-supported decisions (preservation of the autonomy of human intervention)

Recommendation on medical data (1997) Recommendation on health data Major challenges today, relating to the processing of health-related data, which now takes place in an environment that has changed considerably since the adoption of the 1997 Recommendation on the protection of medical data e.g. Data digitisation, geographical mobility + development of medical devices and connected objects

Draft Recommendation on health related data «Health related data definition Data protection principles (transparency, lawfulness, fairness, data quality security measures, data subject’s rights, privacy by design, accountability) Legal basis for processing of health related data Genetic data link with CM/Rec(2016)8 Shared medical secrecy Transparency Data subject’s rights (access, objection, rectification, erasure,portability) Reference frameworks Scientific research Mobile applications

Health data and insurances Recommendation (2016)8 on the processing of personal health-related data for insurance purposes, including data resulting from genetic tests

Next steps: Artificial Intelligence and human rights PACE Recommendation 2102 (2017) on Technological convergence, Artificial Intelligence and human rights EU Parliament Resolution of 16 February 2017 on Civil Law Rules on Robotics Paper of the EDPS on Artificial Intelligence, Robotics, Privacy and Data Protection (International Conference of Data Protection Authorities, 2016) Future work of the Consultative Committee on Artificial Intelligence Future work of the Consultative Committee

A.I.: reinventing the data protection scenario? How does data protection rules for automated decisions apply to autonomous machines? Who is the data controller for an autonomous machine with self-learning capabilities? How to exercise rights towards machines? (…)

To conclude Robotics and A.I. can and should be designed so that that dignity, autonomy and self-determination of the individual are secured Privacy and data protection are pre-conditions for a sustainable and dynamic digital environment Privacy and data protection are not an obstacle, but a necessary requirement to guarantee to all individuals the control of their personal information e.g. in the health sector and prevent discrimination

Thank you for your attention! www.coe.int/dataprotection dataprotection@coe.int a.pierucci@gpdp.it