web 2 0 privacy vincent gautrais professeur agrg

web 2. 0 + privacy vincent gautrais professeur agrégé /associate professor faculté de droit / faculty of law université de Montréal /university of montreal July 10 th, 2009 chaire en droit de la sécurité et des affaires électroniques / udm chair in e-Security and e-Business law www. gautrais. com

plan • • intro what is personal info ? who is in charge to control it ? how to control it ? 2

je me souviens … remember … 3

que né sous le lys … that born under the lily … 4

. . . je crois sous la rose. … I grow under the rose. (Eugène-Étienne Taché) 5

1 6

souvenons-nous que nés sous le papier … remember that born under paper … 2 7

. . . nous croissons sous l’électronique. … we grow under electronic. (Vincent Gautrais) 8

law is under influence 9

legal culture techno Privacy is influenced culture business 10

1 - privacy influenced by legal culture 11

2 - privacy influenced by culture 12

immigrants v. natives (Mark Prensky, Digital natives, Digital immigrants, 2001) 13

3 - privacy influenced by business 14

4 - privacy influenced by techno 15

Michel Serres Les nouvelles technologies : révolution culturelle et cognitive (New Technologies: Cultural and Knowledge Revolution) 16

Michel Serres « when the support / information conbinaison is changing, everything is changing !» 17

internet printing writing 2000 1000 0 - 1000 - 2000 - 3000 - 4000 - 5000 18

Michel Serres « today a pure science professor teaches 60 to 70% of content that he or she doesn’t learn him(her)self in the university» . 19

Hyperlink Web 2. 0 first generation second generation 20

21

what is the consequence on law? did we need some new laws ? Are we OK with old laws ? 22

on one side, some people said … technological neutrality 23

technological neutrality definition ? 24

Definition 1 law doesn’t favour one technology 25

Definition 2 technologies are similarly manageable 26

RAND report (May 2009) review of the european data protection directive (sponsored by UK information commissioner’s office) http: //www. rand. org/pubs/technical_reports/TR 710/ 27

RAND report (page 24) 28

person in charge of personal information is responsible of its protection 29

are you sure that the directive is technological neutral ? 30

privacy laws were create (during seventies and +) under a different technology 31

old electronic technology company (or gov. ) needs to control personal information 32

old electronic technology ex: medical file must be stored in the doctor’s office 33

differences of new electronic technologies • • • protection = circulation place of detention initiative of circulation enhancement of circulation etc. 34

are you sure that the technological neutral approach is the better one? 35

Chris Reed ? (UK) Bert-Jaap Koops ? (Netherland) Lyria Bennett Moses ? (Australia) Vincent Gautrais ? (Canada) no no 36

1) poor definition 2) not sure that laws are techno neutral 3) not sure that it is the best approach 37

on the other side, some others said … we need to consider this (r)evolution of facts 38

on the other side, some others said … we need to consider this (r)evolution of law 39

on the other side, some others said … we need to propose a broadest approach considering 1 – purpose of privacy law 2 – more or less danger 3 – new balance between more circulation and more danger 40

there are some proposed solutions to very basic questions 1 – what 2 - who 3 - how 41

-1 - what ? 42

personal information ? 43

PIPEDA (federal act - S. C. 2000, c. 5) 2 – “personal information” means information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization 44

provincial act - R. S. Q. c. P-39. 1 2 – Personal information is any information which relates to a natural person and allows that person to be identified. 45

ex 1: IP address ? 46

france ex 2: note 2 be. com ? (06/2008: appeal court - France) = Privacy infrigement 47

canada constitutional rights balance ? is it a collection ? ex 2: note 2 be in Canada ? legitimacy of the website ? is it a PI ? intermediaries liability ? 48

germany Spickmich in Germany (June 23, 2009) = no privacy infringement 49

europe direct or indirect personal information ? 50

usa / uk • taxonomy of harms from Daniel Solove (understanding privacy) • RAND report • google 51

RAND report (May 2009) review of the european data protection directive (sponsored by UK information commissioner’s office) http: //www. rand. org/pubs/technical_reports/TR 710/ 52

RAND report (page 41) “Overall, we found that as we move toward an increasingly global, networked environment, the Directive as it stands will not suffice in the long term. The widely applauded principles of the Directive will remain as a useful front-end, yet will need to be supported with a harms-based back-end in due course, in order to be able to cope with the challenges of globalisation and flows of personal data. ” 53

-2 - who? 54

aristotle versus plato 55

substance versus process 56

PIPEDA • • 4. 1 Principle 1 — Accountability An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization’s compliance with the following principles. (…) 4. 1. 4 Organizations shall implement policies and practices to give effect to the principles, including (a) implementing procedures to protect personal information; (b) establishing procedures to receive and respond to complaints and inquiries; (c) training staff and communicating to staff information about the organization’s policies and practices; and (d) developing information to explain the organization’s policies and procedures. 57

Daniel J. Weitzner, Harold Abelson, Tim Berners-Lee, Joan Feigenbaum, James Hendler, and Gerald Jay Sussman, Information Accountability, (2007) 58

“information. Privacy is protected not by limiting collection of data, but rather by placing strict rules on how the data may be used” 59

“In many cases it is only by making better use of the information that is collected, and by retaining what is necessary to hold data users responsible for policy compliance that we can actually achieve greater information accountability” 60

more and more regulations on risk assessment (federal + Quebec) 61

federal (2002) Privacy Impact Assessment Guidelines: A Framework to Manage Privacy Risks 62

quebec (2009) Décret sur la diffusion de l’information et sur la protection des renseignements personnels 63

ex: Chris Kelly = FB chief privacy officer « We’ve always seen ourselves as a leader in reflecting in what users want online and learning what they’re looking for. We saw that in news feed, we saw that in [Facebook] Beacon and we’ve returned to our principle of user control. » 64

ex: Chris Kelly = FB chief privacy officer « We’re constantly looking at ways to make sure that people can get the information they want and they need about their friends in their real world social networks. Sure, we will be working on improving the privacy interface on simplifying it to give people the control that they need. » 65

but be careful … SOX (Sarbanes Oxley Act - 2002) mess 66

sox section 404: Management Assessment of Internal Controls « Rules Required. The Commission shall prescribe rules requiring each annual report required by section 13(a) or 15(d) of the Securities Exchange Act of 1934 to contain an internal control report, which shall: • state the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and • contain an assessment, as of the end of the most recent fiscal year of the issuer, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting » . 67

government company individual 68

-3 - how? 69

as already mentioned … new or old laws ? 70

neutral or “un-neutral” laws? 71

changing or interpretating laws? 72

interpretation communication ? retention ? use ? collection ? 73

ex 1: clicsequr 74

4 – minister 2 3 – identification service 2 – minister 1 – citizen Service to the public 75

communication ? 76

no because no control on information it self (content) 77

ex 2: tourism website 78

79

80

collection ? 81

no because 1) no control on info, 2) no knowledge of PI and 3) ability to erase on demand problematic information 82

consent ? 83

example Additionally, users should be aware that when they voluntarily disclose personally identifiable information (e. g. , user name, e-mail address) on the forums or in the chat areas of the Spain-Info. com sites, that information, along with any substantive information disclosed in the user's communication, can be collected and correlated and used by third parties and may result in unsolicited messages from other posters or third parties. Such activities are beyond the control of Spain. Info. com 84

20 hours each month Aleecia M. Mc. Donald and Lorrie Faith Cranor (Carnegie Mellon University) « The Cost of Reading Privacy Policies » (pdf) 85

ex 3: google street view 86

87

retention ? 88

no because no control on information it self (content) 89

where come from this control criteria ? 90

inherent to privacy protection 91

ex: R. v. Patrick, 2009 SCC 17 92

R. v. Patrick, 2009 SCC 17 [62] Nevertheless, until the garbage is placed at or within reach of the lot line, the householder retains an element of control over its disposition and cannot be said to have unequivocally abandoned it, particularly if it is placed on a porch or in a garage or within the immediate vicinity of the dwelling where the principles set out in the “perimeter” cases such as Kokesch, Grant and Wiley apply. [63] In municipalities (if there any left) where garbage collectors come to the garage or porch and carry the garbage to the street, they are operating under (at least) an implied licence from the householder to come onto the property. The licence does not extend to the police. However, when the garbage is placed at the lot line for collection, I believe the householder has sufficiently abandoned his interest and control to eliminate any objectively reasonable privacy interest. 93

conclusion in some cases, need for new legislations in concordance with electronic huge changes but … 94

conclusion i love interpretation too ! 95

web 2. 0 + privacy vincent gautrais professeur agrégé /associate professor faculté de droit / faculty of law université de Montréal /university of montreal July 10 th, 2009 chaire en droit de la sécurité et des affaires électroniques / udm chair in e-Security and e-Business law www. gautrais. com