European Union Privacy Rights and Controllership, Essay Example

Introduction to European Union Privacy Rights

Privacy is different in different parts of the world.  When it comes to comparing western cultures and their views on privacy the United States and the European Union differ in form and function in that dignity of a person was not the liberty of another to use or abuse.  The privacy of one person is somewhat like a person’s honor in which it cannot be traded like a commodity on the market for profit or for investigative purposes unless proper procedures and protocols are followed.  Under the confines of the European Union Directive on Data Protection of 1995 each nation under the European Union must pass a privacy law to protect the citizen’s privacy.  They must also establish a Data Protection Agency to act as a guardian and facilitator for privacy protection and investigation of privacy protection violations or attacks.

Examples of certain protections afforded by the European Union’s privacy directive include:

• Personal information collection must first have the owner’s permission and the data is reviewable by the owner
• Data processing activities must register their activities with the EU
• Information cannot be shared across borders or to other companies without the expressed consent of the owner
• E-mail and phone numbers are not viewable by the government or employer unless granted access by the owner

This is in stark contrast to that of privacy in the United States where although liberty is provided in the Constitution privacy is not.  Once an individual leaves the sanctity of their home they become subject to privacy inhabitation by those wanted to gain insight into their information and this includes both physically leaving as well as virtually venturing outside.  So with these varying degrees of privacy protection and directives there are rules and regulations set in place so that coordination and progress can be made when countries with differences in statute embark upon coordination of discovery requests.

Role and Responsibilities of the EU Controller for EU Privacy Protection

In order to make clarity out of chaos and facilitate the discovery process there are individuals assigned certain roles and responsibilities.  The first is the controller.  The controller is responsible for the entire compliance of the discovery project and the defense of the scope of privacy stated in the directives of the European Union.  The Data Protection Directive states concisely that the responsibility for compliance rests on the shoulders of the “controller”, meaning the natural or artificial person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data(Official Journal of the European Communities 1995).  This is a broad definition but squarely puts the focus and integrity of the process on the behalf of the controller to maintain.

The controller must abide by certain principles the guide the processing of personal data and only when the principles are met could personal data be transferred.  The three principles are transparency, legitimate purpose and proportionality (Vaas 2005).  Transparency gravitates toward allowing the data subject the right to be informed of the data being processes as well as the parties involved, the data collected and the purpose of the processing.  The data subject must provide consent, enter into a contract for the processing, ensured legal compliance, vital interests protected and all actions must be performed by the controller or by the parties in which the data is disclosed.  The legitimate purpose is semi self-explanatory. The data can only be processed for the specified purpose and not re-purposed or reutilized for any other objective. Proportionality is a vague area but when put to the test by the controller the personal data must be processed only so that is it adequate and relevant to the request at hand.  The restrictions are also scalable depending on what type of information is involved.  For example, if sexual orientation, creed, religion, political stance or other such data is being processed extra precaution and diligence as well as restrictions are applied.

Communication Methods for Discovery Coordination

With a point of contact and directives in place to guide all parties involved how is communication of the data provided to third party countries, countries outside of the EU and not the data subject?  As mentioned before the controller has the ultimate responsibility for safeguarding and following the EU directives (Wolf, Tobin 2011).  It is also imperative that the controller implements technical and organization measures to ensure the stability, protection and safeguard of the data.  There are seven Safe Harbor principles that govern data communication  They are”

• Notice
  • Data subjects are told why U.S. is processing their data
  • Clear, concise and timely
• Choice
  • Data subject must be given the option to opt out
  • Data can only be used for the specific purpose and can be opted out if violation occurs
• Onward Transfer
  • The US, as a third party, must agree to the Safe Harbor Principles
• Security
  • Data is protected from loss, alteration or destruction
• Data Integrity
  • All data is limited to the intended purpose and is accurate, complete and up to date
• Access
  • Access is granted to data subjects
• Enforcement
  • Each data subject will have procedures and policies to safeguard their rights

Summary

In summary, the controller has the highest of responsibility when it comes to protecting the privacy of the European Union’s people.  The proactive approach facilitated by the guidance and representation of the controller contrasts that of the United States in that in the United States there are reactive measures taken in the realm of privacy integrity and protection.  These differences force each party involved to adapt and overcome the hurdles of each other’s process to ultimately garner the necessary data for discovery.  The guidelines are set forth and are clear for each party to follow.  If the proper procedures are followed data discovery, although limited and time constraining, is still effective across borders.

References

Official Journal of the European Communities. (1995) No L. 281. Retrieved from http://old.cdt.org/privacy/eudirective/EU_Directive_.html

Vaas, L. (2005) Eu passes contentious data-retention law. Retrieved from http://www.eweek.com/c/a/Database/EU-Passes-Contentious-DataRetention-Law/

Wolf, C., Tobin T. (2011) Proskauer on international litigation and arbitration: managing, resolving, and avoiding cross-border business or regulatory disputes. Chapter 28 Sec III. Retrieved from http://www.proskauerguide.com/law_topics/28/III