1. by Dr. Viljar Peep by Dr. Viljar Peep Director General Estonian Data Protection Inspectorate 06.10.2015 Transparency and Privacy in Public Sector EUROPEAN SEMESTER cross-border conference in Ljubljana

2. 06.10.2015 LjubljanaAndmekaitse Inspektsioon www.aki.ee 2 Privacy rules – how clear they are? OECD privacy guidelines + CoE Convention 108: a) American approach – sector-based, b) European approach – mainly abstract general law. Lawfullness (legality): legitimate interest, public tasks.

3. 06.10.2015 LjubljanaAndmekaitse Inspektsioon www.aki.ee 3 National privacy borders Similar privacy rules for private sector. Different rules for public sector – data processing is based on national law. Some examples: ● UK real estate registers, ● SE and FI: declared annual income, ● EE: public sector salaries, members of political parties, criminal records.

4. 06.10.2015 LjubljanaAndmekaitse Inspektsioon www.aki.ee 4 Eurobarometer: Europe EU-Estonia EE Do you trust them to protect your data: ● health institutions: 78 %EU – 87 %EE ● banks: 62 %EU – 86 %EE ● national authorities:70 %EU – 84 %EE ● EU institutions: 55 %EU – 62 %EE „Worried: the Govt asks me more and more personal data“: 64 %EU – 40 %EE

5. 06.10.2015 LjubljanaAndmekaitse Inspektsioon www.aki.ee 5 Estonian digital economy, e-Govt 99 % of bank transactions performed electronically. 98 % of enterprises' submissions to companies' register made over the Internet. 95 % of income tax declarations of private persons made via Internet 30 % of voters cast their ballots via Internet in the last parliamentary elections 2015.

6. 06.10.2015 LjubljanaAndmekaitse Inspektsioon www.aki.ee 6 Unique ID-numbers and language barriers ID-number: missing, restricted or public in different Member States. May be neutral or recognizable. Enables cross-usage of databases. Avoids problem of namesakes → sensitive information is more available. Lower linguistic barriers = more privacy-concern.

7. 06.10.2015 LjubljanaAndmekaitse Inspektsioon www.aki.ee 7 SI, UK and EE: implimentation ● Similar ta protection legislation, similar authorities ● SI, UK, EE DPAs: data protection, e- privacy in telecom sector, freedom of information. ● SI, UK, EE DPAs have law enforcement powers. ● What is different?

8. 06.10.2015 LjubljanaAndmekaitse Inspektsioon www.aki.ee 8 EE FoI Act EE FoI Act ● General act for the whole public sector (including environmental information). ● Access by requests + restrictions. ● Management of records/documents, web- based registers of records, clickable access. ● Web-disclosure: websites, central gateway. ● Machine-readability. ● Frame for public sector databases.

9. 06.10.2015 LjubljanaAndmekaitse Inspektsioon www.aki.ee 9 Frame for public sector databases ● all databases are parts of the State Information System, ● once-only principle, ● obligatory supporting systems (x-road, security measures, classificatories etc), ● pre-approval in all stages of life-cycle of databases by IT-Authority, DPA & others ● IT-Authority grants access to the x-road

10. 06.10.2015 LjubljanaAndmekaitse Inspektsioon www.aki.ee 10 FoI Act: oversight competence ● IT-Authority: data security, access to x-road. ● DPA: all ways of access to public sector information, compliance with restrictions, protection of personal data and restricted information. ● Transfer from IT-Authority to DPA 2016 (?): maintenance of databases, including access rights, logs, once-only-principle, data rentention.

11. 06.10.2015 LjubljanaAndmekaitse Inspektsioon www.aki.ee 11 EE DPA: how we work? 1. Surveys, warning letters without investigation, preventive audits, case investigations (binding decisions). 2. Soft law (t.e. General FoI guideline). 3. Networks (t.e. chief privacy and FoI officers of all governmental entities). 4. Partnership: vertical regulators, internal audit units, associations. 5. Consultative tasks, policy advising.

12. 06.10.2015 LjubljanaAndmekaitse Inspektsioon www.aki.ee 12 Good balance is the key Public sector transparency vs privacy of personal data. Public sector transparency vs privacy of personal data. Aim of data protection: protection of fundamental rights, in particular right to privacy. Related rights: free self-realisation, freedom of enterpreneurship, property rights etc. The last but not least: right to good public administration.