MALE SPEAKER: Thank you Peter.
Our third speaker is not called Peter.
He is actually Alexander Alvaro.
We asked Alexander to provide some comments also.
Alexander is a member of the European Parliament and also,
at the parliament, is a member of the
committee on civil liberties.
ALEXANDER ALVARO: Well, thank you very much.
Just to pick up what Peter and Peter have been saying in the
beginning, there is certainly a sense of urgency in terms of
how to deal, now, with online privacy, especially when it
comes to the title of this event, Reconsidering Policy
Options for the Digital Age.
I mean, just to go, like, a couple of years backwards, in
the '90s probably, people we're talking about--
I remember the discussion about Echelon.
And we had all sorts of creepy conspiracy theories.
What's going on?
How are we surveiled?
What about tapping phones, and all these issues?
Actually now, maybe people are not discussing about these
things anymore, although we still don't know if they're in
place or not, just to keep it a little bit in the room.
But actually now, since the internet has come up and how
it's really sped up and changed our lives, we're
seeing more and more that life has been more or less
digitalized.
I mean actually, early days you were going out, you had to
deal with authorities somehow.
You wrote it down on the paper.
They put it in their files.
And you knew after a couple of years, this paper would become
yellow, and it would drop down, probably fall apart.
After 50 years, somebody would pick it up.
Nowadays, you do some sort of online registration if you
move to a different city, if you move
to a different country.
You can do your vehicle registration, in most European
countries, online.
It depends.
So actually you're sure that this data is there somewhere.
Either it's stored with authorities.
Or if you're dealing with private people, then it's in a
private sector.
It's with some company.
It's maybe with Google, maybe with YouTube, maybe with
Yahoo, not to make advertising here.
So it's like, in general, you actually don't know, as a data
subject, where it's going on and where
it's floating around.
It's true, companies truly are trying to provide people with
explanations of what they're doing with your data, and
authorities in some cases also.
So actually one sees that there are some doing the
efforts, and some might not.
Having said that, when we talk about this online privacy, we
have now two representatives, in fact, which represent that
there is a public sector and there's a private sector.
The public sector is where the state, in this case the
European Union or the member states, whoever are
responsible, because they collect your
data, they store it.
They process it somehow.
They deal with it.
Then you have the private sector.
Like, if you have, I don't know, you have a customer card
of a company, or you do search queries, or whatever.
So theirs is a different area.
And I think you have to deal in different
ways with both ones.
Clearly, I think education helps in both cases.
That's true.
We have to tell people what's going on.
And I'm happy to hear that you have so many hits on your
site, explaining how to deal, whatever.
But I mean, let's face it, 60,000 hits.
How many million, billion inhabitants?
How many million, billion users of internet?
And so on.
So we have a certain idea of how many people really know
what's going on.
I mean, there are generations out there still not knowing
how to shut down a computer.
So don't expect them to know what
happens with their emails.
Which is not discriminatory right now.
Sorry if somebody might be offended.
Coming back to the public sector, there's a clear issue
how to deal with data.
There is a limitation of data.
States just cannot collect as much as they want.
I mean, there's a limitation to it.
There must be a clear purpose.
It's not just like, well we could use it one day, talking
of data intention.
And there must be a deletion after the authorities don't
use it anymore, they don't need it anymore.
And this somehow is just floating away.
It's deferring.
Because as we had the Data Retention Directive.
Actually having the average storage age would be quite
difficult, because I believe that article 18 of the
directive says that member states, in exceptional cases,
can extend the storage period as long as they want, as long
as they justify to the commission that there's no
harm to the interior market.
I mean, what does the interior market have to do with that,
in case of extorting data as long as possible?
I think it should more be the question does it violate
fundamental rights in some issues.
That is one of the first substantial amendments of the
2002 58 directive on e-communications privacy.
And we see this is developing in certain terms. Nobody has,
as drastically as that, touched 2002 58 by now.
And I don't know if it would work.
But we're talking about data retention, where your data is
stored somehow electronically.
We're talking about the Treaty of Prum,
what data is exchanged.
It's fingerprint data.
It's vehicle registration data.
Its DNA data which is being exchanged.
We're talking about P&R. I don't know if we will have a
European-wide P&R system.
Just wait what the commission does on 6 of November.
But then there's, again, data flow.
We have Swift.
The Swift is a Belgian company where your financial
transaction data has been checked by the American
Treasury Department.
We have the ATS, Automated Targeting System, where
European data might flow in.
Everything is digital.
And we know that there are ideas to interconnect and to
interlink the databases we have.
So the question is, in the end--
Actually one day, and I think it's not being spooky or being
some conspiracy freak or whatever, but it won't be so
difficult to hit a button if I have a face of somebody, have
bio-metrical registration and then get the data which is
linked within the databases and to have a profile.
I mean, nowadays actually we have seen in anti-terrorist
actions that it is on a limited action, possible.
But it's just a question of technology.
Just to give you an idea what, technology-wise, is out there.
Although it's not online privacy, but it does touch
fundamental rights.
And it fits in this whole context of how do states deal
with their citizens, and how do they deal in terms of
privacy and surveillance and so on.
The Economist, I think of the 27th of September, has quite
an interesting article in terms of civil liberties and
surveillance.
And there are explanations inside.
And I asked a British colleague,
is this really true?
And he said, yeah it is true.
First of all, they have these talking surveillance cameras,
in terms of, please don't throw that away.
And you're like, OK, sorry.
And then on the other hand, it says that there is a firm--
and I double-checked it, and it seems to be true--
which is experimenting on unmanned surveillance drones,
which are quite small.
They're 50 meters high.
They can observe crowds in case of demonstrations.
And the company which developed them is developing
sort of a smart [UNINTELLIGIBLE].
At the remote it can be dropped down.
It has a genetic tag, which means that the people which
have been hit by the [UNINTELLIGIBLE] can be
followed back.
And so on.
I mean, it's not evil by itself, it's just how do you
deal with it and who has it.
Coming back to online privacy, I'm also a little bit worried
when it comes about--
and please don't take this black and white or write it
down, because we haven't seen the plans of
the commission yet--
these ideas of websites blocking.
Of course it's dangerous to have a bomb
instruction on the net.
The police can go in every library, tear out every page
of every engineer book or whatever,
and then delete that.
I would rather think about the idea to talk about the people
who put that in the net and not generally to start
blocking down sites.
Because dealing with civil liberties maybe one is, at a
certain stage, a little bit paranoid.
But please don't quote me on that.
But you see that there's a function creep.
You see that once an instrument is placed, it's
been extended.
We've seen that on data retention.
We actually have foreseen it for serious crimes.
I must admit while we were working on it, we even wanted
it more limited, to have a catalog like the European
arrest warrant.
I see now member states, like Germany for example, mine,
extending it to all crimes, wanting intelligence to have
access to that, and so on.
So, you see, once it's in place, somehow, because it's
so easy, it's just a press of a button.
That is why Parliament has been working really, really
tough on the [UNINTELLIGIBLE]
Data Protection Framework decision together with
[INAUDIBLE]
and the article 29 working group.
And at least we had the commitment from the German
presidency, which ended half-term this year, to say we
want this fulfilled and done until the end of the year.
Now, we see that's the Portuguese are also trying to
work on it, to get it together.
But, I mean, you can count the days until the end
of the year is there.
And I must admit I'm not super confident on this one.
I'm not really 100% convinced that it will be there in the
end of year.
But just a list of the measures we have cruising
around [INAUDIBLE] pillar, and there's no overall data
protection regime, which actually deals with what
challenges do we have in terms of online life, and protection
of people, and states gathering information and
data, and how do we get along with this all.
So I hope that we'll work on that one.
And
I got your message concerning global principles on data
protection and so on.
But frankly I must admit, I see how the proposal of the
parliament in terms of European-wide data protection
system has been watered down by member states, because
they're all like, well don't touch our standards, in terms
of don't put them higher.
And I must say, I would really prefer if we go the step,
maybe even supported by industry, saying look, we
first of all manage to get a European-wide
data protection system.
And from then on, having 27 member states in a quiet,
economical power in back, we go and try to put it then on a
global level.
I think because, right now, we have 27 scattered member
states, we're not knowing what to do, how to deal with it.
The moment you have that economical and political power
together, then I think you can take it to a global level.
But I think we have to do our homework first before we tell
others how to deal with these issues.
When one then looks at the private sector, I mean the
2002 58 does give clear rules and so on.
But since it's a European directive, and we're within
the internet age, and, as you pointed out rightly, there are
companies dealing with the internet, which European
citizens have access to, which are not bound to anything,
probably what 2002 58 is dealing with.
It depends on where they have their location, where they
have their activities, or whatever.
But there are certain loopholes which they just can
jump through.
And then you have I don't know how many billion websites, how
many billion people dealing with these issues.
And not everybody's really like, well, we're not evil.
I mean, there are some outside which probably are.
So these guys are mining, they're profiling.
Just see that the fishing expeditions, within last two
years, have risen about 1,500% in two years, the damage out
of fishing, out of spamming.
And somewhere the people do get these
profiles and the stuff.
And that is probably why sometimes privacy and civil
liberty and justice home affairs, people like me might
be a little bit worried when we talk about query storages.
I mean, I know it's a business of a search engine
company and so on.
Actually we do get a little bit of alert.
And maybe we can discuss that too, how companies do deal
with it, especially when they're outside of the union
European laws.
In fact, at their home place does not apply really, because
we have this dispute with the US, one must say, and it was
highlighted while we're talking about Swift, that the
European part of politics or law idea is it's my data no
matter where it is.
And if you put it on the moon, it's still my data.
I'm the data subject.
I have to deal with it.
While we know that US authorities say, the moment
it's in the US, you don't have anything to
say about it anymore.
We can do what we want.
That's why we get sometimes a little bit worried when we
hear news about, like, emails being
scanned for certain keywords.
Because it's always this slight feeling, what are they
doing with it?
I mean, why are they doing that, and what are they doing
with that data there?
So I think we also have to discuss about the private
sector in terms of online life, and online data
processing, and how one deals with that one.
And I think it's a good idea that you
limit it to 18 months.
But my question would be why don't you delete it after 18
months, and why do you just anonymize it?
So maybe there's a technical reason, which I would know.
But to be very serious, so don't get me wrong, I think
it's a good approach.
It's really an improvement towards what we've seen with a
lot of other companies and how it's going.
The development we will have, we don't know right now, at a
European level, what's going to be on online privacy and
protection.
We have rumors how within the telecommunications review, the
e-privacy directive is going to be amended.
And there is, certainly when you come to breach
notifications, this point in there as far as we suppose,
because, of course, we officially don't have any
documents yet.
It is said, we suppose that there will be a breach
notification inside and obligance for companies.
But I must agree on that issue.
I don't know how the article itself will be formulated, but
I think it would be wise to limit it to certain really
risky, or problematic, or damaging breaches.
I mean, If somebody in a company loses a CD where
personal data is on it, and it is something which probably
would not do any harm or it's crypted anyway, then one
really has to rethink, do you have to make everybody crazy
about what's going on or put everybody in fear?
So that is something where one might think.
I've also heard about a change which I actually do like a
lot, that the commission, as far as it's been talked about,
is wanting to change article five of the directive in terms
of saying that now every storage of data, it's not only
via the electronic communications networks to
store information which will be under the scope of the
directive, but in general the storing of information.
And this includes also the processing.
Personally, while thinking through it, I haven't seen
that there's any trap in there or whatever.
And that's why I talk about civil libertarian guys
becoming paranoid.
But I haven't seen that so far.
And I think it's a good way to say now, in general, we want
to have, under the scope of 2002, the storing of
information which would mean then, consequently, also the
way how you process it.
But we'll have to see what comes out.
We expect a telecommunications review somewhere in
mid-November.
And then we'll see how the developments within the
e-privacy sector will be.
I hope that the commission takes the opportunity to try
to adjust it to the situation we have now, five years after
the first one has been put in place.
And I think it would be maybe good to make clear, because
certain member states have a problem, that to crypt data is
a way also to secure data, also personal data.
Because I know that, for example, also Germany is
really not in favor of people crypting data.
And they want to have the keys in case authorities need that
data, to open it.
And they want the keys put somewhere in their place and
not on the purpose, specifically when they would
need it, which one would say, understandable.
But I'm going to give you the key to my door when you want
to get in, and you're not going to have it so you can go
in every time you want.
That's just a slight difference.
Since we have the European Data Protection Supervisor, I
would love, and I believe member states will never
realize it, will never put it into place, that data
protection authorities would have enhanced powers.
But we see it was in all member states.
I mean, Mr. [? Hussein's ?]
Article 29 working group, the European Data Protection
Supervisor of the member states, they usually are
reasonable people.
They come up with good points, good ideas.
But most members say it goes like, OK thanks for, well,
thanks for your contribution, and we'll see you next time.
So I don't know how you could do it as [INAUDIBLE].
I wouldn't, probably, even go so far to give you some sort
of veto right.
But there must be an instrument how to enhance
powers of data protection authorities.
So just to finish it now, as I said, you might not be evil as
a company, and that's good.
And you don't want to be.
But as I said, others might be.
Others might be.
And the point is it matters who holds the data, who deals
with it, and what one can do.
Because one should not forget--
and actually I usually try to use this comparison on
visitors groups, but now I'm visiting you, so just consider
it vice versa.
It is like data masses, data profiles are such a power to
companies and more even to authorities.
To know, to profile somebody's behavior, to find out what
somebody's doing, to know somebody's intimate thoughts
and behaviors, to know somebody's relations, the
payments they're doing, the car registration, everything,
it is an incredible tool of pressure and blackmailing if
it's in the wrong hands.
And let me say, not from my personal experience, but since
I was born in Germany, I grew up in
Germany, I know my history.
And Germany, in the last 100 years, more or less, had five
different political systems. Starting from the emperor in
the beginning, the Weimar Republic, the Nazis, the
divided Germany, and Germany as we know it today.
At least two of these regimes would have loved to have the
techniques and the data we have today.
And I have a certain idea how they would have used it.
The Nazis, and the federal, and the
Democratic Republic of Germany.
If you've seen the life of the others, you get a certain idea
what you can do with data.
And that's why you should be careful.
Thanks a lot.