Global Forensics 4 Personnel Project, Essay Example

Directive 95/46/EC of the European Parliament and the Council of the European Union was issued on October 24, 1995. The directive addresses the rights of individuals regarding the processing of personal data as well as the free movement of such data. The directive is comprised of 34 articles including Article 19 (Contents of Notification) and Article 28 (Supervisory Authority) (Center for Democracy & Technology (CDT)).

According to Article 19 (Contents of Notification), if a country presents a notification to one or more of the Member States of the European Union, the country requesting the information should include all information as required by the Member State/s. At the minimum, the information from the requester country should include:

• the name of the controller and of his representative if there is any.
• purpose of the processing.
• description of the categories of data subject.
• Recipients to whom the data might be disclosed.
• Proposed transfers of data to third countries.
• General description of the measures taken to ensure a secure processing of the data as required by the Article 17 (Security of processing).

In addition, Member States will also specify the procedures to be followed in notifying the supervisory authority should any change occur in one or more of the above-mentioned requirements (U.S Department of Health and Human Services (HHS)). For the U.S., Article 19 means that FBI will have to specifically inform the Member State/s the information it requires and which senior officials or agents will have access to the data. FBI will also detail how it will ensure a secure processing of the data as required by Article 17 of the directive. FBI will also have to disclose if it intends or expects to share the information with a third country in the course of its investigation. FBI will also be required to inform the Member States should any change/s occur in one or more of the agreement clause/s.

Article 28 (Supervisory Authority) is concerned with enforcing the provisions reached by the Member States regarding the processing of personal data. The main points of the Article 28 (Supervisory Authority) are:

• Each Member State will have at least one public authority that will ensure the application of the provisions contained in the directive.
• These supervisory authorities will be consulted when drawing new administrative measures or regulations governing the protection of individuals’ rights and freedoms in regard to the processing of personal data.
• Each authority will have investigative and intervention powers and they will have the right to pursue legal options when the provisions contained in the directive may have been violated or require attention by the judicial authorities.
• The decisions of the authorities could be challenged in the courts.
• Any person or his/her representative will be able to file a claim with the authority regarding the protection of his rights and freedoms in regard to the processing of data. The claimant will be informed of the outcome.
•  Each supervisory authority will also compile a report on its activities which will be made public.
• Each authority will be well-versed in the laws of the Member State in which it resides and could be asked by another Member State to exercise its powers. The supervisory authorities will be expected to cooperate with each other.
• The members and employees of the authority will be required to protect secrets and other confidential information to which they had access, even after their employment or association with the authority has ended (U.S Department of Health and Human Services (HHS)).

This article basically states that each Member State will have an organization responsible for enforcing the provisions of the directive regarding processing of personal data. The activities of the authority will be public information and every private citizen will have a right to file a complaint and be informed of the outcome. The private citizen will also have the right to challenge the decision of the authority in a court. For the U.S it implies that FBI will have to build a really strong case against the individuals or parties it suspects because European Union laws provide substantial rights and protections to private individuals and parts in regard with the processing of personal data. Thus, the burden will be on the FBI to convince the supervisory authorities that they have a convincing proof that justifies access to data on private individuals even without their consent. Even if the suspected individuals sue, the evidence could be used as a strong defense.

The EU has some of the strictest consumer privacy laws. In many parts of Europe, personal information cannot be collected without consumers’ consent (Sullivan, 2006). The Articles 19 and 28 provide strong protection to private individuals and parties in the EU against unauthorized access of their personal information. Thus, it creates a very difficult task for FBI to build a very convincing case because cause for suspicions won’t be an acceptable reason to request data. FBI could argue that even though the crime originated in one of the Members States, the damage was done to U.S citizens thus, the crimes come within U.S jurisdiction. In addition, FBI can also argue that cyber crimes are equally illegal in EU thus, these cases at least warrant investigation due to the nature and scale of the crimes.

References

Center for Democracy & Technology (CDT). (n.d.). Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Retrieved July 1, 2011, from http://www.cdt.org/privacy/eudirective/EU_Directive_.html#HD_NM_0

Sullivan, B. (2006, October 19). ‘La difference’ is stark in EU, U.S. privacy laws. Retrieved July 1, 2011, from http://www.msnbc.msn.com/id/15221111/ns/technology_and_science-privacy_lost/t/la-difference-stark-eu-us-privacy-laws/

U.S Department of Health and Human Services (HHS). (n.d.). Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Retrieved July 1, 2011, from http://aspe.hhs.gov/DATACNCL/eudirect.htm#ART19