1. Information technologies/NBIC and Big data
Principles at stake – Action(s) to be undertaken at intergovernmental level to address the identified challenges
Alessandra Pierucci
Chair of the Committee of Convention 108
24-25 October 2017

2. Setting the scene - Data Protection legal framework
The Universal Declaration of Human Rights takes as its starting point the inviolability of human dignity + Right to Privacy (article 12)
European Convention on Human Rights:
Right to private life (article 8)
Prohibition of discrimination (article 14)
European Charter of Fundamental rights
- Dignity (article 1)
Right to private life (article 7)
Right to the protection of personal data (article 8)
Non discrimination (article 21)

3. Oviedo Convention and Convention 108/1981
Oviedo Convention and Convention 108 “speak the same language”.
Dignity, identity, non-discrimination, integrity of the individual
Transparency, informed and free consent

4. Data protection standards
Convention Sole legally binding international instrument
51 Parties: 47 member states of the COE plus Mauritius, Senegal Tunisia, Uruguay 
Pending: Argentina, Burkina Faso, Cabo Verde, Morocco invited to accede
Mexico: currently being considered 

5. Convention 108/1981: (some) new elements of the modernised version
New definition on sensitive data (article 6) which now explicitly include genetic data and biometric data
Additional obligations (Article 8bis) for data controllers (Accountability, Data Protection Impact Assessment, Privacy by design)
Strengthened data subject’s rights (not to be subject to automated decisions; to obtain knowledge of the reasoning underlying data processing)

6. Guidelines on Big Data (1)
Big Data as a new paradigm in the way in which information is collected and analysed
Big data can be a source of significant value and innovation
Not all data processed in a big data context concern personal data and human interaction but a large spectrum of it does, with a direct impact on individuals
Legal, social and ethical implications of the use of Big Data for decision-making processes + marginalisation of an effective and informed involvement by individuals in these processes
Need for a broader idea of control over the use of data, not limited to individual control (more complex process of multiple-impact assessment of the risks) 
Need to adapt traditional principles of data processing (data minimisation, purpose limitation, fairness and transparency, and free, specific and informed consent) to the new technological scenario

7. Guidelines on big data (2)
General guidance – to be complemented in sector-specific applications, e.g. Health data
Promoting an ethical and socially aware use of data (e.g. impact assessment, ethical committees)
Preventive policies and risk assessment (DPimpact assessment, privacy by design, accountability)
Purpose limitation and transparency(compatibility of purpose)
Consent (free consent, burden of proof on data controller)
Anonymisation (assessment of the risk of re-identification)
Role of the human intervention in Big Data-supported decisions (preservation of the autonomy of human intervention)

8. Recommendation on medical data (1997) Recommendation on health data
Major challenges today, relating to the processing of health-related data, which now takes place in an environment that has changed considerably since the adoption of the 1997 Recommendation on the protection of medical data
e.g. Data digitisation, geographical mobility + development of medical devices and connected objects

9. Draft Recommendation on health related data
«Health related data definition
Data protection principles (transparency, lawfulness, fairness, data quality security measures, data subject’s rights, privacy by design, accountability)
Legal basis for processing of health related data
Genetic data link with CM/Rec(2016)8
Shared medical secrecy
Transparency
Data subject’s rights (access, objection, rectification, erasure,portability)
Reference frameworks
Scientific research
Mobile applications

10. Health data and insurances
Recommendation (2016)8 on the processing of personal health-related data for insurance purposes, including data resulting from genetic tests

11. Next steps: Artificial Intelligence and human rights
PACE Recommendation 2102 (2017) on Technological convergence, Artificial Intelligence and human rights
EU Parliament Resolution of 16 February 2017 on Civil Law Rules on Robotics
Paper of the EDPS on Artificial Intelligence, Robotics, Privacy and Data Protection (International Conference of Data Protection Authorities, 2016)
Future work of the Consultative Committee on Artificial Intelligence
Future work of the Consultative Committee

12. A.I.: reinventing the data protection scenario?
How does data protection rules for automated decisions apply to autonomous machines?
Who is the data controller for an autonomous machine with self-learning capabilities?
How to exercise rights towards machines?
(…)

13. To conclude
Robotics and A.I. can and should be designed so that that dignity, autonomy and self-determination of the individual are secured
Privacy and data protection are pre-conditions for a sustainable and dynamic digital environment
Privacy and data protection are not an obstacle, but a necessary requirement to guarantee to all individuals the control of their personal information e.g. in the health sector and prevent discrimination

14. Thank you for your attention!