A Directive Behind the Times, Research Paper Example

In 1995, the European Union (EU) designated guidelines for the protection of data. They were simple guidelines which provided little room for the growth of technology, the globalization of information, or the conflicts of privacy and security. In the following paper, Articles 6, 7, and 26 of the 95/46/EC directive will be summarized, analyzed, and discussed. In addition, the clarification of forensic reports and the restriction of electronically-stored information (ESI) are central to these discussions of data protection. In the conclusion, the review of the main points of these directives and their relevance to emergent technology will be summarized in accordance with the literature.

Articles 6, 7, and 26

Although the adoption of these directives was big news on the international front, they bore no direct influence to national policy until various nations implemented policies in accordance with EU mandates. These articles gained exposure through circulation in the November issue of the Official Journal of the European Communities (“Directive 95/46/EC of the European Parliament and of the Council”, 1995).

Article 6 specifies that data collection must be specific, explicit, and legitimate but does not provide the essential determinants by which this conclusion can be reached. It suggests that these information files must be regulated and updated but does not provide a specific timeline for administration. One of the most underemphasized portions of this article requires that this data be kept in good form and kept well-organized, ensuring later verification and sorting.

Article 7 may have inspired a frenzy of fine print. It stated that personal data may be processed only when “the data subject has unambiguously given his consent” or when the subject is party to a contractual agreement (“Directive 95/46/EC of the European Parliament and of the Council”, 1995, p. 40). Nonetheless, the data processing requirements of Article 7 narrow the scope of justifiable obtainment of personal data.

Article 26 makes provisions for domestic law, essentially negating much of the authority of these mandates, ergo “no control of trans-border data flows can be exercised, however serious any breach of the data protection principles…” (“Directive 95/46/EC of the European Parliament and of the Council”, 1995; Aldhouse, 1999, p. 78). It contradicts the scarce regulations of Articles 6 and 7 by stating that, in certain situations, adequate data protection is not mandated prior to data transfer pertaining to individuals (Aldhouse, 1999). International authorities are not required to regulate the compliance with directives, but organizations within a country may arrange for a contracted partnership to monitor these regulations (ibid.).

Forensic Reporting

As previously stated, widespread publication of EU directives is one of the primary means of encouraging responsible (and accountable) forensic reporting. The government takes on a small part of these responsibilities; however, publication in various professional magazines and journals is necessary to the overall success. ESI has more recently been used as a method of illegally gaining access to personal and business data. Clickstream data is one such questionable mode of data collection which stands in the gray area of the EU definition of “personal data”. Domestic laws are given permission to override directives when there is a present and significant threat to security and privacy. For example, United States employers have been granted the legal right to monitor clickstream data to ensure that hourly employees are not misusing company time and resources; consequentially, a 2002 survey discovered that about 80 percent of affluent American companies review this information on a regular basis (Garrie & Wong, 2006). While this makes data transfer a simple matter of observing national law within one country, the globalization of business complicates the rights of individuals who participate in an online, international business.

Format

Forensic reports are utilized for a variety of criminal and civic purposes. As such, such an inclusive proposal for change must be generalized in format and must consider the common needs of various organizations which will be affected. These organizations may include (but are not limited to): medico-legal businesses and psychiatric professionals or organizations (Allnutt & Chaplow, 2000). To comply with professional ethic standards, forensic reporting must consider the Hippocratic oath, clarify roles, receive permission and guarantee confidentiality, respect individual rights to decision-making, formalize issues, grant an appropriate time frame for change, and display specific knowledge of the challenges facing a variety of data-holding businesses (Allnutt & Chaplow, 2000).

Reporting must be clearly organized and itemized. Typically, this consists of a professional journal format which utilizes a format which first lists the article in bold, a one-to-two-word summarization of the topic directly underneath, and a format which lists a point according to a non-Roman numeral, e.g. 1, and each sub-point according to a lower-case letter (“Directive 95/46/EC of the European Parliament and of the Council”, 1995). Findings must be based upon facts and research and show a sound reasoning process which follows the problem from beginning to end. Professional summarizations of any such items is typically saved for the summary and cannot assert that which cannot be proved (Allnutt & Chaplow, 2000).

Terminology

Terminology should always be expressed in a clinical, professional, and unbiased way (Allnutt & Chaplow, 2000). Article 26 includes some complex principles which attempt to simplify an understanding of the rules and procedures therein. These include: a) the purpose limitation principle, b) the data quality and proportionality principle, c) the transparency principle, d) the security principle, and e) the rights and restrictions of transfer (Aldhouse, 1999). Furthermore, any suggested changes must be concise and must provide specific criteria for implementation and regulation (“Directive 95/46/EC of the European Parliament and of the Council”, 1995). Garrie and Wong (2006) adds the principle of necessity, the principle of finality, accuracy and retention of data, and security to these specific foci of each update of EU directives.

Conclusion

The 95/46/EC directives are understandably vague, as the rapid-fire growth of technology outflanked official efforts to regulate and protect data. According to Article 26, it would seem that the EU intended to add or alter these mandates according to projected changes and specific circumstances which are beyond the typical data transfer scenario. One such specific circumstance would be that of international medical data transfer. Regardless, compliance with these directives is situation-specific. In a typical scenario which occurs within the borders of one country, the 95/46/EC requires the information to be obtained with the informed consent of the data subject, to be provable by internet protocol data-tracking or by contractually-valid signed (or e-signed) agreements, and to be appropriately stored, organized, regulated, and maintained.

It must be noted that these directives preceded the emergence of clickstream data. Reforms and additions to directives are necessitated by the sudden non-compliance of these aggressive data-collecting methods which further open up data subjects to a wide variety of security and privacy dilemmas. Internet cookies and virus-ridden links may expose unprecedented amounts of sensitive data to the savvy computer user (Garrie & Wong, 2006). With privacy of information breaches becoming a routine event, the silence of the EU on this front is alarming. Clearly, clickstream data and cookies illegally obtain personal data and thus must be stopped immediately.

References

Directive 95/46/EC of the European Parliament and of the Council. (Oct. 1995). Official Journal of the European Communities, 1(281): 40-50. Sec. I: Principles Relating to Data Quality. Retrieved 6 July 2011 from <http://ec.europa.eu/justice/policies/privacy/docs/95-46-ce/dir1995-46_part2_en.pdf>. Web.

Aldhouse, F. (1999). The Transfer of Personal Data to Third Countries Under EU Directive 95/46/EC. International Review of Law, Computers & Technology, 13(1), 75-79. doi:10.1080/13600869955260.

Allnutt, S. H., & Chaplow, D. (2000). General principles of forensic report writing. Australian & New Zealand Journal of Psychiatry, 34(6), 980-987. Retrieved from EBSCOhost.

Garrie, D. B., & Wong, R. (2006). Demystifying Clickstream Data: A European And U.S. Perspective. Emory International Law Review, 20(2), 563-589. Retrieved from EBSCOhost.