The Looming Privacy Rights Debacle How EU Data Protection Law Will Shape Future Incident Response Team Activities Around The World Thomas Daemen FIRST Conference 2005

1 I.The EU Data Protection Regime II.EU Data Protection Law and Security Investigations III.Ramifications of EU Regulatory Control IV.Conclusions Overview

2 I.The EU Data Protection Regime II.EU Data Protection Law and Security Investigations III.Ramifications of EU Regulatory Control IV.Conclusions

3 EU Data Protection Regime: Data Protection Directive Framework Directive adopted in 1995 –Established overall groundwork –Transposed into national laws –Supplemented by numerous additional law and administrative rules Primary functions –Impose basic obligations on those controlling data E.g., obligations of fair and lawful processing, purpose, relevance, accuracy, retention, security –Vest rights in data subjects E.g., rights of access and modification

4 EU Data Protection Regime: Jurisdiction Threshold question: does the regulation apply to the activity at issue? Framework Directive provides two possible answers –Article 4.1 (a): the laws applies in the context of activities… on the territory –Article 4.1 (c): the law applies if someone make[s] use of equipment … on the territory Case study: Hewlett-Packard ruling

5 EU Data Protection Regime: Enforcement EU US national/sub-national National Data Protection Authorities (DPAs) can: –Investigate –Intervene –Sanction Private right of action –Rarely exercised; seemingly limited to celebrity claimants –Must demonstrate actual harm/damage

6 Overview I.The EU Data Protection Regime II.EU Data Protection Law and Security Investigations III.Ramifications of EU Regulatory Control IV.Conclusions

7 Law and Investigations Overview: The Emerging Debate Public sector arguments in favor of regulatory oversight –Response team processing of personal data –Response team processing of "judicial data" The private sector response –IP addresses are impersonal in nature –Overly broad interpretations of "judicial data" are incorrect

8 Public Sector Arguments: Processing of Personal Data Framework Directive language, Article 2 –[Personal data are] any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number Broad definition, broader interpretation Article 29 Working Party –Represents all 25 EU Member State DPAs –Opines on new technologies and developments

9 Public Sector Arguments: Processing of Personal Data Nov Working Document on Privacy on the Internet –IP addresses may constitute personal data May 2002 Opinion on IPv6 –IP addresses attributed to internet users are personal data and are protected by EU [privacy law] Note: IP addresses qualify as personal data even if not immediately linked to specific individuals

10 Public Sector Arguments: Processing of "Judicial Data" Framework Directive language, Article 8.5 –Processing of data relating to offenses, criminal convictions or security measures may be carried out only under the control of official authority Subject to considerable debate Article 29 Working Party and national authorities uncertain about meaning/impact

11 Public Sector Arguments: Processing of "Judicial Data" Example 1: Belgian DPA IFPI ruling (2001) –IFPI Collected IP addresses, notified police, advised ISPs and sought letter notification Note: IFPI did not identify individuals behind IP addresses –Activities rejected under Belgian data protection/telecom law IP address are personal data even without identification Processing of IP addresses for potential legal claims = judicial processing limited to police authorities Can only process pseudonyms and download date/hour

12 Public Sector Arguments: Processing of "Judicial Data" Example 2: Article 29 Working Party Working Paper on On-Line Enforcement (2005) –Article 8 requires special protections for judicial data –Monitoring on-line activity/IP addresses for misconduct falls within the competence of judicial authorities

13 Private Sector Response: IP Addresses are Impersonal Industry calls for fundamental reassessment of concept that IP addresses constitute protected personal data No legal, public policy or technical rationale –Directive is silent –Limiting response teams = bad public policy –IP addresses are technologically neutral

14 Private Sector Response: Overly Broad Interpretations are Incorrect Art. 8.5 refers only to criminal records Text and legislative history are very specific: no basis for expansive interpretations DPA interpretations inconsistent: Consider Article 29 Working Party Guidelines for Terminated Merchants Databases (2005) –Conditions for merchants' cross-border databases –Working Party: not judicial data/objective facts –How to reconcile with enforcement paper? Safeguards are adequate

15 Overview I.The EU Data Protection Regime II.EU Data Protection Law and Security Investigations III.Ramifications of EU Regulatory Control IV.Conclusions

16 Data Processing Limitations Directive includes broad processing limitations Limitations depend on nature of data and jurisdiction General obligations –Notify national privacy regulators –Obtain processing approval –Inform data subjects

17 Data Transfer Limitations Article 25 limits transfers to countries with adequate protections EU regularly conducts adequacy determinations –Adequate: Switzerland, Argentina –Not adequate: United States Possible solutions –EU/US Safe Harbor Agreement –Data subject unanimous consent –Data transfer agreement

18 Overview I.The EU Data Protection Regime II.EU Data Protection Law and Security Investigations III.Ramifications of EU Regulatory Control IV.Conclusions

19 1)Incident response teams do not operate in a regulatory or political vacuum 2)Policymakers have heeded the publics call for privacy – more, not less, regulatory intervention is expected 3)Response teams must do the same or face increased scrutiny 4)These are not academic debates –Real and far-reaching consequences –Reallocate valuable time and resources 5)This is the time to be heard Summary and Call to Action

20 Thank you