Jusletter IT

Recently, aspects of privacy gained higher attraction in civil society. Many users of electronic network infrastructures such as the Internet have become more sensitive about data collection and data use by large enterprises. In view of the fast moving technologies, laws cannot easily cope with protective measures in this context. Therefore, privacy compliance is more and more an issue for enterprises looking at their reputation for behaving consciously in their fields.

Indeed, the protection of data quality and data integrity has become such an important topic in the life of organizations (80% of the corporate assets are digital nowadays) that the management can not come around the task of establishing a data protection policy. The details of such policy depend upon the range of functions of the given (market) environment. The more sensitive data are hold and treated by an organization, the higher established standards must be developed.

The term «privacy» has successfully defied at giving it a precise meaning.¹ On the one hand, privacy inevitably varies from society to society;² therefore, the existing rules show a patch-work of different provisions. On the other hand, privacy conveys a large number of concepts and ideas.³ Generally looking, three basic features of privacy can be distinguished, namely (i) secrecy, i.e. information known about an individual, (ii) solitude, i.e. access to an individual, and (iii) anonymity, i.e. attention paid to an individual.⁴ Concepts of privacy can be rooted in human dignity, breach of confidence relating to proprietary rights, and protection of individual autonomy from state interference.⁵

In view of these basic features of privacy and the applicable data protection laws, enterprises must develop their strategy for complying with the relevant legal requirements:

• Organizational rules have to describe functions of responsible persons and segregate the duties amongst the persons;
• The policy has to describe the security levels and the measures applied to achieve such levels;
• A project management needs to be implemented and conditions for user participation should be outlined;
• A data classification scheme is to be established in order to control access rights;
• The responsibility and external requirements for review processes must be introduced.

A new instrument which could be used in the context of compliance with data protection regulations is the privacy impact assessment (PIA), generally regarded as a systematic risk assessment tool, that can be usefully integrated into a decision-making process, evaluating a proposal in terms of impact on personal data privacy with the objective of avoiding or minimizing adverse effects.⁶

(i) As to the legal basis of privacy compliance, self-regulation needs to be given closer attention at first instance. Self-regulation follows the principle of subsidiarity, meaning that government intervention should only take place if participants of a specific community are not able to find suitable solutions (structures, behaviors) themselves; since, however, public law defines the contours of private law, it contains aspects of the role of self-regulatory mechanisms.⁷ The legitimacy of self-regulation lies in the fact that private incentives lead to a need-driven rule-setting process.

A major advantage of self-regulation can be seen in the possibility to develop and establish rules independent of the principle of territoriality; other strengths are the efficiency in responding to real needs and mirroring the technology, the openness for a permanent consultation process and for a timely adaption of rules in case of changing technologies, as well as the existence of incentives for compliance with a «self-given» legal framework.⁸ Disadvantages of self-regulation, however, should not be overlooked: The quality of the «legislative» process can hardly be judged under the angle of a democratic participation (problem of outsider), «private norms» are not generally binding in legal terms, self-regulatory mechanisms are not always stable, and – in particular – this kind of legal framework does hardly know enforcement procedures leading to sanctions in case of non-compliance.⁹

(ii) Since technical elements play an important role, the importance of the technology-oriented theory approaches should not be underestimated. In the light of a perceived dissatisfaction with the available regulatory models, Lawrence Lessig developed a new, more technically-oriented approach, the so-called «code-based regulation», for the online world some 10 years ago.¹⁰ According to Lessig, human behavior is regulated by a complex interrelation between four forces, namely law, markets, social norms and architecture.¹¹ Code solutions, similar to legal rules, principally reflect «information» that allocates and enforces entitlements. The design of the code materially influences human behavior since architecture is one of the four regulators; depending on the architecture certain activities will be possible or difficult to carry out.¹² Therefore, Lessig arrives at a world in which code can do much of «the work that the law used to do far more effectively than the law did.»¹³ Consequently, effective regulatory power shifts from law to code based on an effective architectural framework.¹⁴ Lessig’s approach that relates the code/architecture to the control paradigm has not remained uncontested: For example, the aspect of established control structures has a political impact; furthermore, courts should impose checks on the powers of private regulators where such regulation threatens important collective values.¹⁵

(iii) A general surveillance function could be assumed by international legal instruments. The traditional national legislation is confronted with the major disadvantage of the limited scope due to the territoriality principle:¹⁶ Domestic rules «only» apply within the boundaries of the concerned country (at least as long as an extraterritorial effect of the law is not envisaged) and have the consequence that a harmonized level of privacy protection cannot be achieved. Consequently, as it is the case today, national provisions in the privacy field request from data-exporting persons and enterprises to comply with the principle of a comparable level of protection abroad.¹⁷

From a theoretical point of view, a transnational approach is inevitable in the online world.¹⁸ Nevertheless, the development and implementation of internationally harmonized rules is hardly possible if societal perceptions vary so widely as in the case of privacy; since customary law can also not be built on the basis of diverging understandings of privacy, a successful harmonization of rules is not likely to happen. Therefore, internationally binding agreements related to privacy merely exist on a regional level (for example within the European Union). Other legal instruments only have non-binding character (being the case for the UN- and the OECD-Guidelines related to data protection). Fundamental freedoms in Human Rights Conventions often encompass the right to privacy, but the principles are usually worded in a relatively vague way which makes their practical enforceability doubtful. Nevertheless, even if not all desirable principles work out as envisaged, experience with transnational law proves that global problems can be tackled by the international community,¹⁹ which obviously means that the community should strengthen the efforts to negotiate and conclude additional treaties.²⁰

(iv) Compliance, for example in the form of the below discussed privacy impact assessment, must rely on private initiatives and efforts; therefore, self-regulation plays an important role. In addition, technical designs are the basis for implementing privacy standards, thereby realizing the successful implementation of the privacy policies. Cross-border acceptance of privacy measures can increase their reputation and acknowledgement. Consequently, all legal instruments have the potential to exercise a relevant function.

A Privacy Impact Assessment (PIA) offers the data users an «early warning» system since privacy problems might be identified and detected prior to the implementation of certain systems.²¹

The benefits in conducting a PIA encompass the possibility (i) to establish and maintain compliance with privacy and data protection laws and regulations, (ii) to manage privacy risks within an organization and in relation to third persons, and (iii) to provide public benefits through the success of privacy-by-design efforts.²² In addition, a PIA is useful in enabling to adequately consider the impact of an action on personal data privacy, directly addressing the privacy problems in the process, providing solutions or safeguards at the design stage and benchmarking for future privacy compliance audit and control, being a cost-effective way of reducing privacy risks as well as providing a credible source of information to allay any privacy concerns from the public and the stakeholders.²³

Apart from the below thoroughly discussed (and most detailed) PIA related to RFID applications within the European Union, other authorities have also issued general leaflets and guidelines²⁴ or have dealt with the PIA in connection with specific issues such as public security²⁵ or e-government.²⁶

An extensive and still ongoing PIA project concerns the Radio Frequency Identification (RFID) applications. On May 12, 2009, the European Commission issued a Recommendation on the implementation of privacy and data protection principles in applications supported by RFID.²⁷ This Recommendation should become the basis for developing a framework related to privacy impact assessments by the industry, in collaboration with all relevant stakeholders, and supervised by the Article 29 Data Protection Working Party.²⁸ On March 31, 2010, industry representatives delivered a PIA framework proposal which has been reviewed and partly rejected for improvement by the Article 29 Data Protection Working Party. The second proposal has then been approved on February 11, 2011.²⁹ In April 2011, the «inauguration» of the PIA framework on RFID applications was formally enacted and in November 2011 a first review of the actual implementation has taken place.

In the understanding of the EU authorities the PIA should be designed on the basis of the following taxonomy:³⁰

• The PIA is to be introduced as a process making the assessment of privacy impacts of certain activities a conscious and systematic effort.
• The framework should identify the objectives of the (RFID) applications as well as the common structure and content of such applications.
• A PIA report must be made available documenting the PIA process and addressing the review steps of its implementation.
• PIA templates may be developed based on the framework to provide industry-based, application-based, or other specific formats for PIA processes.

According to the relevant documentation, the PIA process related to RFID applications is constructed in two phases:³¹

• A pre-assessment phase classifying the RFID applications according to a four level scale, based on a decision tree.
• A risk assessment phase, broken down in four main steps, namely (i) characterization of the application (data types, data flows, RFID technology, data storage and transfers, etc.), (ii) identification of the risks to personal data and evaluation of the threats (likelihood and potential impact), (iii) identification and recommendation of controls, in response to previously identified risks, and (iv) documentation of the results of the PIA process (incl. conditions for review and information concerning residual risks).

Furthermore, the relevant documentation requests the PIA application operators to establish their own internal procedures in view of supporting the execution of the PIA processes, encompassing for example the following steps:³²

• Scheduling of the PIA process in order to plan the necessary executions and adjustments in time and in compliance with industry requests and the supervision by the competent authorities;
• Internal review of the PIA process (incl. the initial analysis) and of the PIA reports in view of the compliance with the applicable documentation and the factual implementation of the relevant measures;
• Compilation of supporting artifacts (for example results of security reviews, control designs) as evidence that the processes are executed in a proper way;
• Determination of the persons and/or functions within the organization who have the authority for relevant actions during the PIA process;
• Provision of criteria of how to evaluate and document whether the actual applications are ready for deployment consistent with the PIA framework and any relevant PIA template;
• Consideration/identification of factors that would require a new or revised PIA process, for example due to significant changes in the applications, failures in the processes, weaknesses in implementation measures, etc.
• Stakeholder consultation in order to receive the appropriate feedback from all directly or indirectly involved persons/organizations/authorities and, thereupon to be in a position of improving the PIA process.

If issues or even problems occur, a specific corrective action plan needs to be developed; relevant risks identified should be appropriately mitigated in order to assure that no significant residual risks remain and a new PIA might have to be executed.³³

In the course of the fundamental revision of the EU Directive on Data Protection 95/46³⁴ which has been launched on January 25, 2012,³⁵ the EU Commission proposes to include a specific provision related to a data protection impact assessment into the future legal frame-work in the newly drafted Data Protection Regulation.³⁶ Art. 33 para. 1 of the proposal reads as follows:

«Where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes, the controller or the processor acting on the controller’s behalf shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.»

Thereafter, the proposed provision lists specific (data protection) risks in case of data processing (para. 2), followed by the conditions to be fulfilled by the impact assessment (para. 3), namely the description of the envisaged processing operations and of the risks to the rights and freedoms of data subjects, the measures envisaged to address the risks, safeguards, security measures and mechanisms to ensure the protection of personal data. Furthermore, additional provisions regulate the exchange of views on a PIA and the supervision by the competent authorities (paras. 4–7).³⁷

The outcome of the legislative process is obviously not yet known. However, the opposition to a pre-final draft of the legal framework which unintendedly surfaced in November 2011 to the public mainly concerned the form (Regulation instead of Directive), the introduction of new fundamental rights (such as the right to be forgotten) and the extended supervisory regime with massive powers of data protection surveillance authorities, but it was not directed against the principle of a privacy impact assessment. Therefore, the fair assumption might be expressed that the PIA is going to survive the legislative process and will come into force, expectedly in 2014.

So far, concrete proposals regarding the introduction of the PIA concept do not exist in Switzerland. Nevertheless, Art. 11 para 1 of the Swiss Data Protection Act (Swiss DPA)³⁸ contains a provision stating that in order to improve data protection and data security, both the manufacturer of data processing systems and data processing programmes, private individuals and federal bodies processing personal data may undergo an evaluation of their systems, processes and their organization carried out by independent certification authorities. However, serving as a basis for legal recognition of certifications for data protection, the validity of Art. 11 Data Protection Act only has a limited effect; for example, a certification gives no clear statement about to what extent the rules of the Data Protection Act are observed by the respective enterprise.³⁹ Furthermore, the certification according to the wording of Art. 11 para 2 Swiss DPA is of voluntary nature and therewith includes no demandable obligation. But Switzerland might consider implementing some features of the ongoing EU revision of data protection legislation into the next already envisaged amendment to the DPA.

If compliance with data protection standards through a privacy impact assessment should be successful, some elements are of particular importance.

The objective of a risk assessment is to identify the privacy risks caused by specific processes or applications; the discussed RFID applications are a new technological tool, but may only serve as an example since privacy risks occur in virtually every business and in government. Therefore, the development of an adequate and appropriate risk design is crucial.

In the context of a PIA, privacy risks are to be concretely identified. Notwithstanding the fact that each industry or business is confronted with some specific privacy risks it seems to be possible to list «critical factors» which might be applicable in virtually all market segments. On that note, the following privacy risks should be taken into consideration:⁴⁰

• No data collections for unspecified and unlimited data collections;
• No data collections exceeding their purpose;
• Avoidance of incomplete information and lack of transparency;
• No combinations of data collections exceeding the given purpose of collection;
• Lack of erasure policies or mechanisms;
• Avoidance of invalid explicit consent to data collection (for example threat);
• No secrete data collection;
• Avoidance of a situation of inability to grant access;
• No technical/operational measures preventing objections by data subjects;
• Lack of transparency of automated individual decisions;
• Insufficient access right management;
• Insufficient authentication mechanisms;
• Illegitimate data processing;
• Insufficient logging mechanisms;
• Uncontrollable data gathering.

Seen from the angle of the data subject, the relevant factors of privacy risks which are to be taken into account encompass (i) the functions and activities of the data users, (ii) the nature of the personal data involved, (iii) the number of individuals affected, (iv) the gravity of harm caused in case of improper handling of data protection rules and (v) the compliance with the privacy standards contained in applicable codes, policies, practices and regulations.⁴¹

Ideally, already at an early stage of a system’s development the efforts should be directed to a pro-active mitigation of risks through technical and organizational controls.⁴² The better the precautionary measures realize the requested privacy objectives, the less likely problems will occur during the PIA process afterwards. Sometimes, PIA leaflets of data protection authorities contain valuable lists of possible measures for avoiding and mitigating privacy risks.⁴³

Risk assessment processes are known from many segments of the industry, mainly the high-technology and also the health fields. Lessons learned could be that risk assessments should be run at an early stage prior to the decision of definitely implementing certain systems, that measures susceptible to malicious attacks should be avoided and applications already configured in a privacy friendly way should get a special preference.

Generally looking, despite the difficulties, it is unavoidable that in addition to the identification of the risks, a PIA process includes a relative quantification of the risks, i.e. the PIA operator must consider, as guided by the principle of proportionality and under reasonable conditions, whether privacy risks are likely or not likely to realize in the processes executed in the business.⁴⁴ Such kind of risk assessment requires evaluating the applicable risks from a privacy perspective, encompassing the significance of the risk, the likelihood of its occurrence and the magnitude of the impact (low, medium, high) in case of its occurrence.

A generally important problem in the risk assessment context concerns the uncertainties and complexities inherent in risk analyses and the use of science (technology) policies. Usually, three aspects of scientific evaluation are taken into account:⁴⁵ (i) balancing categories of evidential reasoning, (ii) judging data and theories, and (iii) considering desiderata of rationality. The balancing categories concern how to weigh different risk estimates; judging data encompasses the determination of quality of data and theories used, depending on statistical properties, methodology, reliability, relevance and the level of scrutiny by the scientific community. Rationality is described as including conceptual clarity for all terms used in the discourse, logical deduction, methodological rigor, practicality, ontological realism, epistemological reflection, and valuation.

So far, experience with the application of PIA is still limited and knowledge must be gained in practice. The first review of the efforts related to the RFID PIA in November 2011, however, gives at least some confidence that this instrument could also be used in other contexts.⁴⁶

Since an international harmonization of data protection laws might be unlikely to happen during this decade, the merits of a well-drafted privacy policy by the concerned entity (business, government) should not be underestimated, particularly since guidelines and models are available and experiences have already been gained.⁴⁷ This assessment goes along with the fact that according to studies related to regulations governing the transborder flow of data an organizationally-based approach making data exporters accountable for ensuring the continued protection of personal data is the most viable tool for an appropriate privacy framework.⁴⁸ Obviously, adequate governing practices within the organization must be put in place and, even more, accountability measures are to be implemented.⁴⁹

In order to improve the privacy legal framework it has been proposed by legal scholars to turn to a «IT-security legislation» approach.⁵⁰ This concept encompasses initiatives that demand the establishment of reliable IT-security standards which should protect from unauthorized disclosure of data; for example, new industry-based technological standards could introduce stringent safeguards. Thereby, technological «norms» would delineate a legal concept in which a broad scale of privacy problems can be designated.⁵¹ Such kind of approach has the advantage of leading to a concept of relational privacy taking into account the specific demands of the manifold data subjects.⁵² Furthermore, the implementation of an adequate PIA could eventually mitigate civil liability.⁵³

From a technological angle a pro-active integration of privacy principles in a system’s design should be achieved in the form of privacy-by-design concept.⁵⁴ This term can be defined as a pro-active engineering and management approach enabling a selective and sustainable minimization of information systems' privacy risks through technical and governance controls.⁵⁵ The seven fundamental principles of privacy-by-design are:⁵⁶ (i) proactive not reactive; preventive not remedial, (ii) privacy as the default setting, (iii) privacy embedded into design, (iv) full functionality – positive-sum, not zero-sum, (v) end-to-end security – full lifecycle protection, (vi) visibility and transparency – keep it open, (vii) respect for user privacy – keep it user-centric.

Summarizing, the PIA enables the concerned entities to design the conditions of the data protection framework according to the individual needs. Since the risks for privacy and non-disclosure of personal data are different in not identical circumstances, the protection measures should also be different, i.e. technology as precautionary means should assist in trying to achieve the (at least) second-best solution for the implementation of the data protection regime by a PIA. Insofar, privacy rules can be individualized and matched with the concrete needs in the given environment.

The non-compliance with the above described precautionary principles related to a legal risk management concept regarding privacy by the responsible persons of an organization can lead to personal liability. Even without a specific harmonization of legal systems in this field, corporation laws usually provide for a liability if the governing bodies of an organization do not comply with the appropriate managerial duties. In the meantime, legal doctrine widely accepts that the implementation of a risk management system in information infrastructures (including data protection) is indeed a task and thereby a legal obligation of the management.

Apart from the legal responsibility as such, compliance with data protection rules is also a matter of perception and reputation. Therefore, many organizations have recognized in the meantime that the establishment of an adequate data protection policy can constitute an inherent business value, for example as «selling argument» in electronic transactions with customers.⁵⁷ Consequently, the notion of a systemic data protection calling for an overall regime to protect data quality and data integrity gains importance.⁵⁸

In particular, private institutions and associations have introduced procedures which allow reviewing the data protection policy of specific organizations on a self-regulatory basis. If the targets of a respective audit are met, the concerned organization receives a certificate related to its compliance with data protection rules which can be used as a label.⁵⁹ Another possibility consists in the introduction of ratings judging the level of data protection on the enterprises in a specific market.

 

---

Rolf H. Weber is Chair Professor for Business Law at the University of Zurich, Visiting Professor at the Hong Kong University and attorney-at-law in Zurich.

 

This article is based on an earlier contribution of the author: Privacy Impact Assessment – A Privacy Protection Improvement Model?, in: 25th IVR World Congress, Law, Science and Technology, Paper Series No. 039/2012, Series B, pp. 1-13, http://publikationen.ub.uni-frankfurt.de/frontdoor/index/index/docId/24897.

 

---