On 8-9 June 2012, NGO Internews, with the support of the Annenberg School for Communication of Pennsylvania University and USAID, organised a “Conference on Internet Governance, Policy and Regulation” in Sarajevo (Bosnia-Herzegovina). Cedric Laurant presented some of the current challenges that privacy and data protection present for the defense of freedom of expression in Bosnia-Herzegovina. Several representatives from the Bosniak Minister of Communications, Communications Regulatory Authority, USAID and the Council of Europe assisted to the event, as well as from Bosniak NGOs working on freedom of expression issues and media organisations, together with international Internet governance, free speech and privacy experts from Europe and the United States. Panels covered the issues of privacy, data protection and free speech in the digital age, online security, and Internet governance, policy and regulatory aspects. More information at http://www.ulys.net/fr/conferences-489/current-privacy-and-data-protection-challenges-for-the-defense-of-free.html

1. CONFERENCE
ON
INTERNET
GOVERNANCE,
POLICY
&
REGULATION
(SARAJEVO,
BOSNIA-­‐HERZEGOVINA,
8-­‐9
JUNE
2012)
INTERNEWS
&
ANNENBERG
SCHOOL
FOR
COMMUNICATION
Cédric
Laurant
A5orney-­‐at-­‐Law,
Cabinet
Ulys
(Brussels)
Principal,
Cedric
Laurant
ConsulAng
www.ulys.net
-­‐
www.droit-­‐technologie.org
1

2. RETENTION
AND
ONLINE
SEARCH:
HOW
CURRENT
CHALLENGES
FOR
PRIVACY
BECOME
NEW
THREATS
FOR
FREEDOM
OF
EXPRESSION
ü IntroducAon:
2
illustraAons
www.ulys.net
-­‐
www.droit-­‐technologie.org
2

3. RETENTION
AND
ONLINE
SEARCH:
HOW
CURRENT
CHALLENGES
FOR
PRIVACY
BECOME
NEW
THREATS
FOR
FREEDOM
OF
EXPRESSION
ü 1)
public
authority’s
surveillance
by
data
retenAon
mandates
www.ulys.net
-­‐
www.droit-­‐technologie.org
3

4. CHALLENGE
TO
PRIVACY
–
THREAT
TO
FREE
SPEECH?
q How
threats
to
privacy
may
present
a
threat
to
free
speech:
§ 1.
public
authority’s
surveillance
by
data
retenAon
mandates
www.ulys.net
-­‐
www.droit-­‐technologie.org
4

5. THE
CASE
OF
MALTE
SPITZ
http://www.zeit.de/datenschutz/
malte-spitz-data-retention
q The
case
of
Malte
Spitz
www.ulys.net
-­‐
www.droit-­‐technologie.org
5

6.
“How
much
informa[on
do
you
give
online
every
day?
And
who
has
access
to
it?”
See
h`p://vimeo.com/19289724
www.ulys.net
-­‐
www.droit-­‐technologie.org
6

7. THE
CASE
OF
MALTE
SPITZ
www.ulys.net
-­‐
www.droit-­‐technologie.org
7

8. THE
CASE
OF
MALTE
SPITZ
http://www.zeit.de/ q 6
months
of
phone
records
(“traffic
datenschutz/malte- data”),
enhanced
with
records
of
spitz-data-retention the
Malte
Spitz’s
tweets
and
blog
entries
q Person’s
profile
q Person’s
rela[onships
q Where
he
lives,
works,
spends
[me
with
friends,
spouse?...
lovers?
q Indirectly
reveals
his
poli[cal,
philosophical,
even
sexual
preferences.
www.ulys.net
-­‐
www.droit-­‐technologie.org
8

9. THE
CASE
OF
MALTE
SPITZ
q Ques[ons:
q Does
this
threaten
Malte
Spitz’s
right
to
associate
with
others?
To
travel?
To
communicate
or
interact
with
whom
he
wishes?
q Does
data
reten[on
poten[ally
place
every
ci[zen
under
suspicion?
q Could
such
surveillance
end
the
presump[on
of
innocence?
q …
www.ulys.net
-­‐
www.droit-­‐technologie.org
9

10. RETENTION
AND
ONLINE
SEARCH:
HOW
CURRENT
CHALLENGES
FOR
PRIVACY
BECOME
NEW
THREATS
FOR
FREEDOM
OF
EXPRESSION
ü 2)
private
sector’s
surveillance
through
online
behavioural
and
targeted
adverAsing
techniques
www.ulys.net
-­‐
www.droit-­‐technologie.org
10

11. CHALLENGE
TO
PRIVACY
–
THREAT
TO
FREE
SPEECH?
q How
threats
to
privacy
may
present
a
threat
to
free
speech:
§ 1.
public
authority’s
surveillance
by
data
retenAon
mandates
§ 2.
private
sector’s
surveillance
through
online
behavioural
and
targeted
adver[sing
techniques
www.ulys.net
-­‐
www.droit-­‐technologie.org
11

12. “COLLUSION”
www.ulys.net
-­‐
www.droit-­‐technologie.org
12

13. “COLLUSION”
q A
Firefox
add-­‐on
that
allows
you
to
see
which
sites
are
using
third-­‐party
cookies
to
track
your
movements
across
the
Web.
It
shows,
in
real
[me,
how
that
data
creates
a
spider-­‐web
of
interac[on
between
companies
and
other
trackers.
www.ulys.net
-­‐
www.droit-­‐technologie.org
13

14. “WHAT
THEY
KNOW”
(WALL
STREET
JOURNAL)
http://blogs.wsj.com/wtk/
www.ulys.net
-­‐
www.droit-­‐technologie.org
14

15. RETENTION
AND
ONLINE
SEARCH:
HOW
CURRENT
CHALLENGES
FOR
PRIVACY
BECOME
NEW
THREATS
FOR
FREEDOM
OF
EXPRESSION
ü 1.
How
can
violaAons
of
individuals’
privacy
affect
their
freedom
of
speech?
www.ulys.net
-­‐
www.droit-­‐technologie.org
15

16. 1.
HOW
CAN
VIOLATIONS
OF
YOUR
PRIVACY
AFFECT
YOUR
FREEDOM
OF
SPEECH?
q Ar[cula[on
between
privacy
and
freedom
of
speech.
q Privacy
as
a
core
human
right
and
a
condi[on
for
freedom
of
expression.
(But
also
freedom
to
travel,
to
associate,
etc.)
www.ulys.net
-­‐
www.droit-­‐technologie.org
16

17. RETENTION
AND
ONLINE
SEARCH:
HOW
CURRENT
CHALLENGES
FOR
PRIVACY
BECOME
NEW
THREATS
FOR
FREEDOM
OF
EXPRESSION
ü 2.
Challenges
to
individuals’
privacy:
illustraAons
of
how
actual
or
hypotheAcal
infringements
to
individuals'
privacy
have
led,
or
may
lead,
to
a
restricAon
of
their
freedom
of
expression
www.ulys.net
-­‐
www.droit-­‐technologie.org
17

18. 2.1.
DATA
RETENTION
q How
regula[ons
in
Europe
manda[ng
the
reten[on
of
communica[ons
data
-­‐
e.g.,
online
traffic
and
mobile
communica[ons
-­‐
on
online
service
providers
and
telecommunica[ons
companies,
have
affected
Internet
users,
consumers
and
individuals’
right
to
privacy
and,
as
a
result,
their
freedom
of
speech.
q Delega[on
by
the
state
of
law
enforcement-­‐specific
du[es
to
the
private
sector
(Choicepoint
case).
www.ulys.net
-­‐
www.droit-­‐technologie.org
18

19. DATA
RETENTION
IN
EUROPE
Extract
from
the
European
Privacy
&
Human
Rights
2010
report.
Map
available
at
h5ps://www.privacyinternaAonal.org/projects/global-­‐country-­‐reports
www.ulys.net
-­‐
www.droit-­‐technologie.org
19

20. Struggles
against
data
reten[on
in
Central
and
Eastern
Europe
Case
study
of
Poland
(by
Katarzyna
Szymilewicz,
Panoptykon)
www.ulys.net
-­‐
www.droit-­‐technologie.org
20

21. •
Overview
of
data
reten[on
regimes
(and
struggles
against
them).
•
2011
case
study
of
Poland
contrasted
against
the
cases
of
Hungary,
Bulgaria,
Lithuania,
Czech
Republic
and
Romania:
necessity
and
propor[onality
revisited.
•
Interpreta[ons?
www.ulys.net
-­‐
www.droit-­‐technologie.org
21

22. Purpose
limita[on
for
data
reten[on
www.ulys.net
-­‐
www.droit-­‐technologie.org
22

23. fiscal
offences,
for
use
by
prosecutors
and
courts
if
relevant
to
the
court
proceedings
pending,
for
the
purpose
of
the
Internal
Security
Agency,
Foreign
Intelligence
Agency,
Central
AnA-­‐CorrupAon
Bureau,
Military
Counter-­‐intelligence
Services
and
Military
Intelligence
Services
to
perform
their
tasks.
Hungary
To
enable
invesAgaAng
bodies,
the
public
prosecutor,
the
courts
and
na[onal
security
agencies
to
perform
their
du[es,
and
to
enable
police
and
the
Na[onal
Tax
and
Customs
Office
to
invesAgate
intenAonal
crimes
carrying
a
prison
term
of
two
or
more
years.
Bulgaria
For
‘discovering
and
inves[ga[ng
severe
crimes
and
crimes
under
ArAcle
319a-­‐319f
of
the
Penal
Code
and
for
searching
persons’.
Lithuania
For
the
inves[ga[on,
detec[on
and
prosecu[on
of
serious
and
very
serious
crimes,
as
defined
by
the
Lithuanian
Criminal
Code.
Romania
&
Not
transposed.
Czech
Rep.
www.ulys.net
-­‐
www.droit-­‐technologie.org
23

24. Access
to
retained
data
www.ulys.net
-­‐
www.droit-­‐technologie.org
24

25. Poland
Police,
border
guards,
tax
inspectors,
Internal
Security
Agency,
Foreign
Intelligence
Agency,
Central
AnA-­‐CorrupAon
Bureau,
military
counter-­‐
intelligence
services,
military
intelligence
services,
th.e
courts
and
the
public
prosecutor.
Requests
must
be
in
wri[ng
and
in
case
of
police,
border
guards,
tax
inspectors,
authorised
by
the
senior
official
in
the
organisaAon.
Hungary
Police,
NaAonal
Tax
and
Customs
Office,
naAonal
security
services,
public
prosecutor,
courts.
Police
and
the
NaAonal
Tax
and
Customs
Office
require
prosecutor’s
authorisaAon.
Prosecutor
and
naAonal
security
agencies
may
access
such
data
without
a
court
order.
Bulgaria
Specific
directorates
and
departments
of
the
State
Agency
for
NaAonal
Security,
the
Ministry
of
the
Interior,
Military
InformaAon
Service,
Military
Police
Service,
Minister
of
Defence,
NaAonal
InvesAgaAon
Agency;
the
court
and
pre-­‐trial
authoriAes
under
the
condiAons.
Access
only
possible
on
the
order
of
the
Chairperson
of
a
Regional
Court.
Lithuania
Pre-­‐trial
invesAgaAon
bodies,
the
prosecutor,
the
court
(judges)
and
intelligence
officers.
Authorised
public
authoriAes
must
request
retained
data
in
wri[ng.
For
access
for
pre-­‐trial
invesAgaAons
a
judicial
warrant
is
necessary.
Romania
&
Not
transposed.
Czech
Rep.
www.ulys.net
-­‐
www.droit-­‐technologie.org
25

26. Reten[on
periods
www.ulys.net
-­‐
www.droit-­‐technologie.org
26

27.
Poland
2
years.
Hungary
6
months
for
unsuccessful
calls
and
1
year
for
all
other
data.
1
year
Bulgaria
Data
which
has
been
accessed
may
be
retained
for
a
further
6
months
on
request.
Lithuania
6
months.
Romania
&
Not
transposed.
Czech
Rep.
www.ulys.net
-­‐
www.droit-­‐technologie.org
27

28. Number
of
requests
for
retained
data
in
2009
www.ulys.net
-­‐
www.droit-­‐technologie.org
28

29.
Poland
1
048
318.
Hungary
None
provided.
Bulgaria
None
provided.
Lithuania
72
473.
Romania
None
provided.
Czech
Republic
280
271.
www.ulys.net
-­‐
www.droit-­‐technologie.org
29

30. (
POLAND
number
of
requests
for
retained
data:
2009
–
1
048
318
(total
for
the
EU:
2
051
082)
2010
–
1
382
521
www.ulys.net
-­‐
www.droit-­‐technologie.org
30

31. POLAND
data
checks
performed
in
2009
Central
An[-­‐
corrup[on
Internal
Bureau
Security
4%
Agency
13%
Military
Intelligence
Courts,
11%
Prosecu[on
and
Police
Border
Guard
56%
15%
Military
Fiscal
police
Intelligence
0%
1%
www.ulys.net
-­‐
www.droit-­‐technologie.org
31

32. Types
of
data
checks
performed
by
6
agencies
between
Jan
2009
and
Oct
2010
Billing
data
34%
Subscriber
data
54%
Geoloca[on
9%
Other
3%
www.ulys.net
-­‐
www.droit-­‐technologie.org
32

33. RECENT
DEVELOPMENTS
SHOWING
CHALLENGES
TO
LEGALITY
AND
LEGITIMACY
OF
DATA
RETENTION
LAWS
IMPLEMENTED
IN
EASTERN
EUROPEAN
MEMBER
STATES
q
Romania:
ConsAtuAonal
Court:
blanket
data
retenAon
unconsAtuAonal
per
se
(2009);
new
drag
data
retenAon
bill
introduced
in
Parliament
(2011),
but
rejected
by
Senate
(end
2011).
q
Czech
Republic:
ConsAtuAonal
Court:
naAonal
provisions
implemenAng
the
DirecAve
recognised
not
proporAonate
(2011);
Chamber
of
DepuAes’
current
a5empts
to
reintroduce
data
retenAon
(2012).
q
Bulgaria:
Supreme
AdministraAve
Court
revised
and
amended
naAonal
law
on
data
retenAon
on
the
basis
of
unconsAtuAonality
with
Bulgarian
ConsAtuAon
and
ECHR
(2008).
q
Hungary
&
Poland
–
pending
cases.
www.ulys.net
-­‐
www.droit-­‐technologie.org
33

34. RECENT
DEVELOPMENTS
SHOWING
CHALLENGES
TO
LEGALITY
AND
LEGITIMACY
OF
DATA
RETENTION
LAWS
IMPLEMENTED
IN
EASTERN
EUROPEAN
MEMBER
STATES
q European
Court
of
Jus[ce:
decision
expected
soon
that
will
assess
compaAbility
of
data
retenAon
mandate
of
Data
RetenAon
DirecAve
with
respect
to
the
fundamental
right
to
privacy.
q European
Commission:
suing
Germany
for
failing
to
implement
the
Data
RetenAon
DirecAve
(May
2012)
q Other
EU
Member
States:
q Germany:
ConsAtuAonal
Court
declared
unconsAtuAonal
the
naAonal
data
retenAon
law
(March
2010).
§ Court
ordered
deleAon
of
collected
data.
§ Court
stated:
data
retenAon
could
“cause
a
diffusely
threatening
feeling
of
being
under
observa@on
that
can
diminish
an
unprejudiced
percep@on
of
one's
basic
rights
in
many
areas.”
q Ireland:
Court
referred
to
European
Court
of
JusAce
a
case
challenging
legality
of
Data
RetenAon
DirecAve
(thanks
to
an
Irish
NGO)
(May
2010).
q Cyprus:
Supreme
Court:
parts
of
data
retenAon
law
are
unconsAtuAonal
(Feb.
2011).
www.ulys.net
-­‐
www.droit-­‐technologie.org
34

35.
INTERPRETATIONS?
www.ulys.net
-­‐
www.droit-­‐technologie.org
35

36. www.ulys.net
-­‐
www.droit-­‐technologie.org
36

37. “RENAUT”
DATABASE
DATABASE
(REGISTRO
NACIONAL
DE
USUARIOS
DE
TELEFONÍA
MÓVIL)
q Used
in
Mexico
by
the
police…
and
the
mafia
(!);
q Contains
name,
tel.no.
and
ID
no.
(Clave
Única
de
Registro
de
Población);
q Useful
to
locate
OTHER
EXAMPLES
OF
HOW
ACTUAL
INFRINGEMENTS
TO
someone.
INDIVIDUALS'
PRIVACY
HAVE
LED
TO
A
RESTRICTION
OF
THEIR
FREEDOM
OF
EXPRESSION
www.ulys.net
-­‐
www.droit-­‐technologie.org
37

38. RETENTION
AND
ONLINE
SEARCH:
HOW
CURRENT
CHALLENGES
FOR
PRIVACY
BECOME
NEW
THREATS
FOR
FREEDOM
OF
EXPRESSION
ü 2.2.
How
making
an
online
search
can
reduce
freedom
of
speech?
www.ulys.net
-­‐
www.droit-­‐technologie.org
38

39. 2.2.
HOW
MAKING
AN
ONLINE
SEARCH
CAN
REDUCE
FREEDOM
OF
SPEECH?
q Profiling
by
online
marke[ng
industry,
data
aggregators
and
other
online
adver[sing
companies:
characterisa[on
of
Internet
user
as
a
type
of
consumer
fiwng
into
marke[ng
and
data
mining
categories,
which
in
turn
may
affect
their
choices
online
as
a
consumer,
computer
user,
individual
or
ci[zen.
q “Dynamic”
pricing:
discriminatory
aspects.
q Google’s
new
merged
privacy
policy
and
consequences
(example
of
search
in
Google
and
YouTube
while
logged
on
through
gmail
account).
q Facebook’s
subject
access
request
(Max
Schrems’
case:
h`p://europe-­‐v-­‐facebook.org).
q Rapleaf
case:
tying
of
an
e-­‐mail
address
to
a
profile.
q “SSN”
case:
individual’s
date
+
place
of
birth
(zip
code)
sufficient
to
guess
his/her
Social
Security
No.
q Facebook
“Apps”:
h`p://online.wsj.com/ar[cle/
SB10001424052702303302504577327744009046230.html#ar[cleTabs%3Dinterac[ve
www.ulys.net
-­‐
www.droit-­‐technologie.org
39

40. RAPLEAF
CASE
http://s.wsj.net/
public/resources/
documents/
st_RAPLEAF_2010
1018.html
www.ulys.net
-­‐
www.droit-­‐technologie.org
40

41. OUTLINE
(1/2)
q Introduc[on:
2
illustra[ons
showing
extent
of
the:
q a)
Challenges
to
privacy,
and
q b)
How
they
may
present
a
threat
to
free
speech:
§ 1)
public
authority’s
surveillance
(data
retenAon):
Malte
Spitz’s
case
§ 2)
private
sector
surveillance
(WSJ
“What
They
Know”
example
of
3rd
party
tracking
through
online
behavioural
adverAsing).
q 1.
How
viola[ons
of
your
privacy
can
affect
your
freedom
of
speech:
q 1.1.
ArAculaAon
between
privacy
and
freedom
of
speech.
But
also
freedom
to
travel,
to
associate,
etc.
q 1.2.
Privacy
as
a
core
human
right
and
a
condiAon
for
freedom
of
expression.
www.ulys.net
-­‐
www.droit-­‐technologie.org
41

42. OUTLINE
(2/2)
q 2.
Challenges
to
individuals’
privacy:
illustra[ons
of
how
actual
or
hypothe[cal
infringements
to
individuals'
privacy
has
led,
or
may
lead,
to
a
restric[on
of
their
freedom
of
expression
q 2.1.
Data
retenAon:
how
regulaAons
in
Europe
mandaAng
the
retenAon
of
communicaAons
data
affect
users
and
consumers'
right
to
privacy
and,
as
a
result,
their
freedom
of
speech.
q 2.2.
How
making
an
online
search
can
reduce
freedom
of
speech?
q
3.
Take-­‐aways
www.ulys.net
-­‐
www.droit-­‐technologie.org
42

43. 3.
TAKE-­‐AWAYS
q What
solu[ons?
q EU
legal
framework
(ECHR,
EU
Chart
FR,
DP
Dir.,
DP
Reg.).
q Integra[on/adapta[on
of
Bosniak
legal
framework
within
the
EU
framework.
q Civic
engagement
and
public
opposi[on
in
Eastern
European
countries
(cfr
Eastern
European
cons[tu[onal
courts’
decisions
on
data
reten[on).
q Impact
of
Civil
Society
&
NGOs.
q Ci[zens’
public
trust
in
their
government
and
public
ins[tu[ons
(cfr
data
reten[on
slides).
q Risks
of
discrimina[on.
www.ulys.net
-­‐
www.droit-­‐technologie.org
43

44. CONFERENCE
ON
INTERNET
GOVERNANCE,
POLICY
&
REGULATION
(SARAJEVO
8-­‐9
JUNE
2012)
THANK
YOU
FOR
YOUR
ATTENTION
!
ULYS, a Moder- and Human Law Fir5, Dedicated to Innovation !
53
e
sh a lom,
M
nn E
EL
Ha
BE LGIU la
Couro
FR ANC
ISRA ,
Derech
ULYS enue
de
ULYS Galilée
ULYS ower
av e
red
T 0
224
lles
10
33
ru ris
0
11
Ve ayim
70
2
B ruxe 0
88 6
Pa
70
9 ivat
770
1050 2
34
7511 )1
40 0
01
38
G
(0)3
19
2
(0) 5
80
(0
+9 72 0
70
+3 45
3
+33
7 Tel
: 3
77
Tel
: )2
3 Tel
: )1
40 2
(0)
32
(0 33
(0
+97
Fax
:
+
F ax
:
+ Fax
:
ü New
Technologies,
Privacy
&
ICT
AREAS
OF
EXPERTISE
ü Intellectual
Property
Cédric
Laurant
ü Cinema,
Media
&
Entertainment
A5orney-­‐at-­‐Law,
Cabinet
Ulys
(Brussels)
ü E-­‐Payment,
E-­‐Finance
&
Internet
Banking
(Member
of
the
Brussels
and
District
of
Columbia
Bars)
ü Sport
&
Gaming
Principal,
Cedric
Laurant
ConsulAng
ü Commercial
Law
[cedric.laurant
[at]
ulys
[dot]
net]
[c
[at]
cedriclaurant
[dot]
com]
www.ulys.net
-­‐
www.droit-­‐technologie.org
44

45. PresentaAon
available
at:
h5p://blog.cedriclaurant.org
www.ulys.net
-­‐
www.droit-­‐technologie.org
45