Help
Add this page to your book
Show book (0 pages)
Suggest pagesData Protection: IMCO Opinion
IMCO is the European Parliament committee on Internal Market and Consumer Protection issues.
On 28 January 2013, it issued an opinion on the Proposal for a Data Protection Regulation aimed to assist LIBE committee in the drafting of its own report.
You can find a detailed list of its members on Memopol or visit its official website.
Its opinion proposes many amendments which would severely weaken personal data protection.
This page lists and analyses the most dangerous of them.
Contents
Pseudonymous data[edit]
Amendment 61
- 3.(b) 'pseudonymous data' means any personal data that has been collected, altered or otherwise processed so that it of itself cannot be attributed to a data subject without the use of additional data which is subject to separate and distinct technical and organisational controls to ensure such non attribution, or that such attribution would require a disproportionate amount of time, expense and effort
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
Amendment 75
- 1. Processing of personal data shall be lawful only if and to the extent that at least one of the following applies:
- (a) the data subject has given consent to the processing of their personal data for one or more specific purposes;
- ...
- (fe) only pseudonymous data is processed.
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
These two amendments provide that data which are not directly collected or processed together with the data subject's name may be collected or processed without the data subject's consent, even though these data are tied to an unique identifier - which may be linked to the data subject's name in another dataset - or may otherwise be easily linked back to the data subject, as shown in sudies on recent re-identification advances.
Consent[edit]
Amendment 63
- 8. ‘the data subject's consent’ means any freely given indication that must be specific, informed and as explicit as possible according to the context, of his or her wishes by which the data subject, either by a statement or by a clear affirmative action, explicitly whenever the data referred to in Article 9(1) are to be processed, signifies agreement to personal data relating to them being processed;
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
The explicit consent requirement is the core of this proposal. It is based on the idea that users can only trust the data industry if they can control exactly who knows what about them and that only explicit consent would give them such a control. This amendment states that, depending on the context, users may not always be able to give an explicit consent - that it may be impossible or too difficult to. Or, except when they are unconscious, there is absolutely no context in which data subjects may not be able to accept something explicitly. This amendment is actually just a way to admit "contextual consent" - passive consent - when it would be considered to be "sufficient" - according to unknown criteria - even though the only way to gain users' trust would be, in any context, to require their explicit consent.
Purpose limitation[edit]
Amendment 66
- Personal data must be:
- (a) processed lawfully, fairly and in a transparent manner in relation to the data subject;
- (b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes;
- (c) adequate, relevant, and
limited to the minimum necessarynot excessive in relation to the purposes for which they are processed; they shall only be processed if, and as long as, the purposes could not be fulfilled by processing information that does not involve personal data;
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
This amendment provides that data may be processed for other purposes that users have consented to, as long as these "new purposes" are not too disconnected from the one accepted by the user. Once again, it is actually just a way to admit processing that data subjects have not explicitly consented to.
Amendment 77
- 4. Where the purpose of further processing is not compatible with the one for which the personal data have been collected, the processing must have a legal basis at least in one of the grounds referred to
in points (a) to (e) ofparagraph 1. This shall in particular apply to any change of terms and general conditions of a contract.
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
A data subject may only accept his data to be collected for a specified and specific purpose. Thus, these data cannot be processed in a way incompatible with this purpose, except in five limited cases (paragraph 1 points (a) to (e)): new consent is given, the data subject is party to a contract which requires this process, his vital interests are at stake or public interest demands this process. This amendment extends these narrow exceptions to the broad and dangerously vague concept of legitimate interest (paragraph 1 point (f)).
A similar amendment has been voted in JURI (amendment 49).
Exceptions to consent[edit]
Amendment 69
- 1. Processing of personal data shall be lawful only if and to the extent that at least one of the following applies:
- (a) the data subject has given consent to the processing of their personal data for one or more specific purposes;
- ...
- (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or for the performance of a task carried out for assessing creditworthiness or for fraud
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
Even if it would be relevant that banks may evaluate the creditworthiness of their customers, there is no reason why these information should be collected without the consent of the latter. If someone wants to subscribe to a loan, its banker should directly ask him the needed information. Otherwise, it would give banks an unnecessary freedom to collect and process personal data with no control at all from data subjects.
Amendment 70
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
The third party's legitimate interest exception was already provided by the 1995 Directive. The proposal goes back on this exception as it does not fit the new context of the Internet where controllers are trading thousands of personal data with hundreds of companies every day.
This exception would bring an unacceptable uncertainty by allowing the "legitimate interest" of one of these many companies to override data subjects' right to privacy, the "legitimate interest" concept being in itself way too vague, undefined and let to the interpretation of the judges, when privacy should be entirely, precisely and directly protected by the Regulation.
Similar amendments have been voted in ITRE (amendment 100) and JURI (amendment 47) committees.
Amendment 71
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
This exception would be acceptable if it only concerned information that data subjects have explicitly decided to make publicly known to be linked to them - such as curriculum vitae published on professional network, for instance.
In other cases, such as messages published on common social networks or under a pseudonym, data subjects may not want that anyone can link these information back to them.
Actually, this amendment alone would allow to process and identify without the data subjects' consent any information they have published using a pseudonym.
Profiling[edit]
Amendment 130
- 1. A data subject shall not be subject to a decision which is unfair or discriminatory, and which is based solely on automated processing intended to evaluate certain personal aspects relating to this data subject.
Every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person, and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person's performance at work, economic situation, location, health, personal preferences, reliability or behaviour
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
Amendment 131
2. Subject to the other provisions of this Regulation, a person may be subjected to a measure of the kind referred to in paragraph 1 only if the processing:- (a) is carried out in the course of the entering into, or performance of, a contract, where the request for the entering into or the performance of the contract, lodged by the data subject, has been satisfied or where suitable measures to safeguard the data subject's legitimate interests have been adduced, such as the right to obtain human intervention; or
- (b) is expressly authorized by a Union or Member State law which also lays down suitable measures to safeguard the data subject's legitimate interests; or
(c) is based on the data subject's consent, subject to the conditions laid down in Article 7 and to suitable safeguards.
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
The Proposal offers to strongly regulate profiling measures because such measures are inherently doomed to lead to unfair and discriminatory decisions. These amendements propose to withdraw any safeguard the Proposal set, letting companies free to profile citizens as far as none of their 'decisions' is brought to court.
Controller's liability[edit]
Amendment 144
- 1. Where a processing operation is to be carried out on behalf of a controller and which involves the processing of data that would permit the processor to reasonably identify the data subject, the controller shall choose a processor providing sufficient guarantees to implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject, in particular in respect of the technical security measures and organizational measures governing the processing to be carried out and shall ensure compliance with those measures. The controller remains solely responsible for ensuring compliance with the requirements of this Regulation.
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
This amendment is the verbatim copy of one of the amendments proposed by Amazon to the JURI's MEPs (amendment 34 page 17)
It provides that a controller may ask any company to collect and process personal data on its behalf regardless the garuantees it offers, except where the processed data can reasonably permit to identify the data subject. But this criteria is excessively vague and may result in controllers never evaluating at all the processor they hire. More, this amendment also states that controllers may only be responsible for their own activities, no matter what the processor they chose does.
Data breach[edit]
Amendment 162
- 1. In the case of a personal data breach, which would have a significantly adverse impact on the protection of the personal data or privacy of the data subject, the controller shall without undue delay
and, where feasible, not later than 24 hours after having become aware of it,notify the personal data breach to the supervisory authority.The notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours.
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
Amendment 169
- 3. The communication of a personal data breach to the data subject shall not be required if the data breach does not have significant risk of harm to citizens and the controller demonstrates to the satisfaction of the supervisory authority that it has implemented appropriate technological protection measures, and that those measures were applied to the data concerned by the personal data breach. Such technological protection measures shall render the data unintelligible to any person who is not authorised to access it.
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
These amendments would let companies decide whether a security breach should be notified to the supervisory authority and data subjects or not, depending on their assesment of its impact's nature and degree. But as long as such an incident harms companies' reputation, we can not rely on them to spontaneously notify every important breach. Thus, controllers should notify each of them.
Similar amendments have been voted in ITRE (amendments 245 & 255) and JURI (amendment 111).
Transfer to third countries[edit]
Amendment 192
- 1. In the absence of an adequacy decision pursuant to Article 41 or of appropriate safeguards pursuant to Article 42, a transfer or a set of transfers of personal data to a third country or an international organisation may take place only on condition that:
- ...
- (h) the transfer is necessary for the purposes of the legitimate interests pursued by the controller or the processor, which cannot be qualified as frequent or massive or where, prior to such transfer, the personal data is already made public in the third country, and where the controller or processor has assessed all the circumstances surrounding the data transfer operation or the set of data transfer operations and based on this assessment adduced appropriate safeguards with respect to the protection of personal data, where necessary.
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
See comment on amendment 71: there is no reason that personal data which have been made public would not be protected just as other data are.
Complaints[edit]
Amendment 198
2. Any body, organisation or association which aims to protect data subjects’ rights and interests concerning the protection of their personal data and has been properly constituted according to the law of a Member State shall have the right to lodge a complaint with a supervisory authority in any Member State on behalf of one or more data subjects if it considers that a data subject’s rights under this Regulation have been infringed as a result of the processing of personal data.
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
IMCO committe simply proposed to remove from the Regulation the right data subects would have to be represented by an organisation during a procedure aimed to defend their fundamental right to privacy.
Amendment 200
4. A data subject which is concerned by a decision of a supervisory authority in another Member State than where the data subject has its habitual residence, may request the supervisory authority of the Member State where it has its habitual residence to bring proceedings on its behalf against the competent supervisory authority in the other Member State.
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
This amendments proposes that data subjects who disagree a foreign authority's decision can not be represented by their national authority but should bring procedure against the foreign authority on their own.
The only purpose of these two amendments is to avoid that citizens may bring procedure against controllers too easily. Despite "IMCO" stands for "Internal Market and Consumer Protection", these amendments clearly show that, in order to address companies' concerns, this committee is ready to deprive consumers of ways to defend their rights.
Similar amendments have been voted in ITRE (amendments 360 & 362) and JURI (amendments 170, 172 & 174).
Sanctions[edit]
Amendment 208
- 3. In case of a first and non-intentional non-compliance with this Regulation, a warning in writing may be given and no sanction imposed, where:
- (a) a natural person is processing personal data without a commercial interest; or
- (b) an enterprise or an organisation employing fewer than 250 persons is processing personal data only as an activity ancillary to its main activities.
4. The supervisory authority shall impose a fine up to 250 000 EUR, or in case of an enterprise up to 0,5 % of its annual worldwide turnover, to anyone who, intentionally or negligently:- (a) does not provide the mechanisms for requests by data subjects or does not respond promptly or not in the required format to data subjects pursuant to Articles 12(1) and (2);
(b) charges a fee for the information or for responses to the requests of data subjects in violation of Article 12(4).
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
Amendment 209
- (a) does not provide the information, or does provide incomplete information, or does not provide the information in a sufficiently transparent manner, to the data subject pursuant to Article 11, Article 12(3) and Article 14;
- (b) does not provide access for the data subject or does not rectify personal data pursuant to Articles 15 and 16 or does not communicate the relevant information to a recipient pursuant to Article 13;
- (c) does not comply with the right to be forgotten or to erasure, or fails to put mechanisms in place to ensure that the time limits are observed or does not take all necessary steps to inform third parties that a data subjects requests to erase any links to, or copy or replication of the personal data pursuant Article 17;
- (d) does not provide a copy of the personal data in electronic format or hinders the data subject to transmit the personal data to another application in violation of Article 18;
- (e) does not or not sufficiently determine the respective responsibilities with co-controllers pursuant to Article 24;
- (f) does not or not sufficiently maintain the documentation pursuant to Article 28, Article 31(4), and Article 44(3);
(g) does not comply, in cases where special categories of data are not involved, pursuant to Articles 80, 82 and 83 with rules in relation to freedom of expression or with rules on the processing in the employment context or with the conditions for processing for historical, statistical and scientific research purposes.
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
Amendment 210
- (a) processes personal data without any or sufficient legal basis for the processing or does not comply with the conditions for consent pursuant to Articles 6, 7 and 8;
- (b) processes special categories of data in violation of Articles 9 and 81;
- (c) does not comply with an objection or the requirement pursuant to Article 19;
- (d) does not comply with the conditions in relation to measures based on profiling pursuant to Article 20;
- (e) does not adopt internal policies or does not implement appropriate measures for ensuring and demonstrating compliance pursuant to Articles 22, 23 and 30;
- (f) does not designate a representative pursuant to Article 25;
- (g) processes or instructs the processing of personal data in violation of the obligations in relation to processing on behalf of a controller pursuant to Articles 26 and 27;
- (h) does not alert on or notify a personal data breach or does not timely or completely notify the data breach to the supervisory authority or to the data subject pursuant to Articles 31 and 32;
- (i) does not carry out a data protection impact assessment pursuant or processes personal data without prior authorisation or prior consultation of the supervisory authority pursuant to Articles 33 and 34;
- (j) does not designate a data protection officer or does not ensure the conditions for fulfilling the tasks pursuant to Articles 35, 36 and 37;
- (k) misuses a data protection seal or mark in the meaning of Article 39;
- (l) carries out or instructs a data transfer to a third country or an international organisation that is not allowed by an adequacy decision or by appropriate safeguards or by a derogation pursuant to Articles 40 to 44;
- (m) does not comply with an order or a temporary or definite ban on processing or the suspension of data flows by the supervisory authority pursuant to Article 53(1);
- (n) does not comply with the obligations to assist or respond or provide relevant information to, or access to premises by, the supervisory authority pursuant to Article 28(3), Article 29, Article 34(6) and Article 53(2);
(o) does not comply with the rules for safeguarding professional secrecy pursuant to Article 84.
lawbox|title=Amendment 100|rate=-|1=Vive la liberté d'expression !|2=Vive la liberté d'expression ! d'entreprise
Modèle en boucle détecté : Modèle:Lawbox</noinclude>
These three amendements dismiss the proposed sanctions but does not provide to replace them with other - 'better' - ones. It would actually mean that IMCO considers that no fine or sanction (except 'warning in writing') should be imposed to companies infriging the Regulation.
Similar amendments have been voted in ITRE (amendments 370-397) and JURI (amendments 176, 178 & 180).
