Personal Data Protection - EU Directive and Member State Laws. OECD Guidelines (Chinese/English Contrast): EU Directive and Member State Laws. OECD Guidelines (Chinese/English Contrast)

Author: None
Publisher:
Publish Date: 2006-11-01
Features: Personal data protection and privacy rights are not new concepts. However, since privacy rights were proposed over a hundred years ago, there has been little change at the fundamental level: the task of the discipline under the title "data protection" remains to ensure that everyone has the right to self-determination regarding personal information related to them. In the era we call the "information society," the new problem is that there are now so many ways to collect, store, and publish personal information. The traces we leave while surfing the internet can be read more clearly than fresh footprints in fresh snow: this can be to our advantage (when online retailers know our preferences and improve the information they provide to us) or to our disadvantage (when malware tracks our usage patterns and passwords and sends "private" information to abusers). A person who once registered for an online newsletter or participated in a competition may have the experience of personal data appearing through unexpected channels: you enter a television streaming website, and it returns to you a surprising amount of unwanted commercial emails or popular product information specifically targeted at the region where you live. The information society is sometimes also called the "information jungle," and this is not just because it is hard to find the imports and exports, but also because it means that to discover something very valuable and useful—information—in the jungle, one must engage in a brutal struggle with the jungle beasts. The legitimacy of privacy rights does not need to be proven. It stems from the individual's right to self-determination, and this right is based on the idea that the individual is the ultimate and sole source of legitimacy (this can be called a "methodology of individualism"). This means that as a fundamental principle, everyone has the right to self-determination over what personal data can be collected, stored, or published. Only recently, the Federal Constitutional Court of Germany once again emphasized that privacy rights have a core component that no state may infringe upon. Since the 1980s, privacy rights have had the status of a fundamental human right in the EU. However, why ensuring privacy and protecting personal data is a core issue for everyone in the process of social modernization has very practical, factual, and commercial reasons. The lack of such protection would lead to a lack of trust between business partners in e-commerce and between citizens and the government in e-government. Online users would doubt that online retailers would sell their data to other companies, which would then launch an anonymous spam campaign through email or other conventional methods, causing online users to abandon providing their data (they know and mind this risk). Citizens would doubt that housing authorities would share their data with tax authorities, leading citizens to reconsider registering in their new hometown. To some extent, all potential beneficial inventions of the information society (e-government, e-commerce, electronic social networks, online participation, etc.) depend on mutually trustworthy commitments that personal data will not be used for purposes not consented to. This is even more important because it sometimes conflicts with efforts to make processes more efficient and citizen-friendly. The electronic government one-stop shop, as an entry point for e-government, must integrate the backend processes of different government departments. A necessary step in these integration processes is to establish a single database to gather information stored by departments such as tax authorities, housing authorities, public health departments, etc. Clear and explicit institutional frameworks and regulations are needed here. Finding a balance between these conflicting goals is what data protection laws and regulations aim to solve. A perfect data protection system would create an environment where, on the one hand, it encourages the use of electronic communication methods, and on the other hand, individuals retain primary control over the use of their data (and they themselves can also influence this balance, for example, if companies are willing to share benefits with affected individuals by consciously allowing the sale of personal information to "affiliate partners" in e-commerce and thus influence this balance). Does the EU have a perfect data protection system? No. There is no perfect solution in this complex matter. However, the EU has quite comprehensive systems for protecting personal data and ensuring privacy. Further detailed review is needed to determine which theoretical and practical considerations can be introduced into China's personal data protection regulations. EU countries have a large number of privacy and data protection regulations, not all of which originate from EU institutions (the Organization for Economic Cooperation and Development, the European Parliament, and the United Nations have all adopted highly relevant principles of core data protection rules). The 1995 EU Data Protection Directive is the core of EU data protection regulations. It established a series of principles and rules that all member states must implement. It ensures the free flow of data within the EU and sets common standards for personal data protection. The principles it establishes apply to all areas of private or commercial life. The fundamental principle may be the one stipulated in Chapter 7, which asserts that the processing of personal data is generally an exception that requires justification (it is related and substantially similar to the provisions typically found in freedom of information laws, which establish transparency principles and require justification for retaining information). Since 2002, the Privacy and Electronic Communications Directive (following the earlier terms for telecommunications services) has supplemented the general directive by explicitly specifying privacy provisions for all forms of electronic communication. Although the interdependence between these two main data protection directives is sometimes debated among experts, these documents have proven to be crucial in establishing the institutional framework for the European information society. Personal data protection will always be a hot topic of discussion. As new technologies, new policy issues, or new approaches emerge (such as RFID, counterterrorism efforts, e-government integration projects, to name a few examples), the fundamental principles need to be continuously interpreted. If they are good and strong principles, they will withstand these challenges and not only guide EU member states but also provide good examples for other countries willing to share this experience. The EU-China Information Society Project was initiated to support this knowledge sharing. It aims to support China's economic and social reforms by fostering the information society through the joint efforts of the European Commission and the Chinese government. Part of the project focuses on supporting specific government projects in all of China's partner cities. The other part covers the regulatory environment of the information society, striving to support the establishment of a sound, comprehensive legal and policy system to allow all members of society to derive the maximum specific benefits from what is called the information society. Supporting the development of personal data protection policies is part of this effort. Of course, there is no doubt that the EU and China's current and future data protection systems will have some significant differences: One important difference is that the EU is not a single country, and the subsidiary principle that is present in all EU policies leads to different ways of institutionalizing privacy protection. This is why it is not only necessary to examine the regulations at the EU level but also to examine how different member states implement these regulations, i.e., how data protection is interpreted differently within Europe. These interpretations will show very interesting aspects for those who examine the EU from the outside and seek useful principles and details that can be transplanted into their own societies. Publications like this one play an important role in this regard. They allow both sides to discuss the same basic documents and principles without language barriers. This will serve as a valuable starting point for developing China's future personal data protection system. It is clear that drafting and passing a law is only one element of establishing a credible and reliable data protection system. Industry efforts, such as codes of conduct, privacy education for users on how to use their data cautiously, and the development of privacy-enhancing technologies in hardware and software, will play equally important roles. The EU-China Information Society Project hopes to contribute to these aspects and support China in establishing a comprehensive personal data protection system.