On November 2 – 3, 2011, about 600 persons from around the world attended the 33rd International Conference of Data Protection and Privacy Commissioners. For those unable to make the trek to Mexico City, what follows is selected insight gained from several folks who attended and were kind enough to report back what was discussed in Mexico.
The event opened with an exposition of the “big data” concerns driving many large privacy programs. Ken Cukier of The Economist used the example of how the Sumo wrestling scandal was uncovered using big data analytics, i.e., a complete analysis of 10 years’ worth of Sumo contests, to showcase the fast, ubiquitous, and distributed nature of big data. A common big data thread turned on the data collection activities of Facebook and Google – with an obvious concern regarding their future usage of collected data. It was pointed out that a browser configuration is so customized now that it can act as a fingerprint indentifying its owner — leading to even more big data concerns.
Two other covered substantive topics were, not surprisingly, social media and mobile technologies. Tied to social media was the purported “right to be forgotten.” Building on prior conferences, it appears as if the commissioners in attendance believed future regulations will eventually create such a right in the EU. The question of enforcement was not really deemed much of a concern – which is curious given it would be wishful thinking to think anyone can actually completely scrub the Internet of one’s personal data. Moreover, do we really even want bad information regarding a professional such as a doctor or lawyer ever completely wiped clean?
As for mobile discussions, one session focused exclusively on the ramifications of having over five billion mobile users worldwide. In ten years time, it was estimated there would be 20 billion SIM cards in use connecting multiple devices to each other. In effect, chips will be everywhere processing and collecting data — leading to ever-increasing privacy challenges.
Another area of discussion was the “interoperability” of privacy laws around the world. The lofty notion of harmonization was abandoned in lieu of the more workable interoperability concept. This new perspective would entail better cooperation between the various commissioners with perhaps an executive committee to assist in such coordination efforts. The committee would deal with global issues that would require better cooperation, e.g., regulatory efforts involving multi-national corporations potentially impacting the privacy rights of persons in many countries.
An interesting sidebar on interoperability was the ability to use of common regulations instead of directives. Such a change in course would take much longer to implement given the need to, for example, go to a Parliament to pass such regulations. It was assumed this path would take 3 – 5 years to implement. On the other hand, it would allow for much more in the way of teeth to an executive committee’s agenda.
There was also an interesting debate between the commissioners regarding their perceived roles. It was universally acknowledged that they are overwhelmed by the explosive privacy issues impacting their respective offices. What was not universally acknowledges was how they should prioritize their time in meeting this challenge. One school of thought (spearheaded by Chris Graham, the UK Information Commissioner) was that commissioners and their offices should be counselors assisting companies reach relevant privacy standards — a definitely carrot-centric approach. The combating school of thought (voiced strongly by Jacob Kohnstamm, Head of the Article 29 Working Group and Chairman of the Dutch Data Protection Authority) was that only enforcement sticks should be used. Mr. Kohnstamm said that companies have had enough time to be compliant and it is now time to enforce existing laws. He also apparently stated that even if he wanted to act as a counselor he does not have sufficient advisory personnel on staff to act in that role. Interestingly, this divide may also be attributable to a common law vs. civil law axis. Given that Mr. Kohnstamm is up for election as head of the Article 29 Working Group, his election may end up being a referendum on this debate.
There was also interesting insight gained regarding the difference in styles between two newly installed commissioners; the newfound influence of Asia at the conference; the focus — for the first time — on privacy violations involving state actors; and a belief that the closed session resolutions may formalize the working relationships between the various commissioners and their respective offices.
There is no doubt that the global privacy landscape is expanding at a rapid rate and that this conference will only grow over time – next year it will be at a resort in Uruguay. Simon Davies, Director of Privacy International, even spoke about how countries such as Pakistan and Afghanistan are now starting a privacy dialogue. The Dragon also took a privacy bow when Zhou Hanhua of the Chinese Academy of Social Sciences in Beijing gave a keynote address that discussed the new revisions to China’s penal code regarding privacy infractions as well as its revisions to Identification and Telecommunications laws to better address privacy concerns. And, it was even mentioned Korea will host the conference in a few years.
In other words, there can be no denying privacy is and will forever be a global issue. In fact, that truism may very well be the reason this year’s Conference of Data Protection and Privacy Commissioners was titled “PRIVACY: The Global Age.”