EDRI-event at Data Protection Conference in Montreux

EDRI and a coalition of civil liberty groups has organised a pre-event at
the international conference of data protection commissioners on 12
September in Montreux. The aim was to strengthen cooperation between NGOs
and official data protection authorities (DPAs). The meeting was
well-attended by NGOs, privacy officials and industry representatives and
led to promising discussions on how to improve collaboration in the
future.

The panel on data retention noticed the interesting development of an
emerging “rainbow coalition” between civil liberties groups, DPAs,
Internet and telecommunication providers, and the European Parliament.
Hielke Hijmans from the Office of the European Data Protection Supervisor
(EDPS) presented the concerns of the EDPS. He made it clear that
“terrorism is not out of this world when you retain data”, and while
protecting our societies, “we must not forget our basic values like
privacy, as enshrined in article 8 of the European Convention on Human
Rights”. Because data retention is already applied in some EU member
states, the EDPS is currently working under the assumption that an EU
directive can not be stopped completely. Therefore, they focus on
safeguards and limiting types of data and retention periods. Cédric
Laurant from co-organiser EPIC pointed out that data preservation regimes
(only retaining data in specific investigations) “have not prevented
law-enforcement agencies from doing their job”. Even the heavily
criticised Council of Europe’s Cybercrime Convention only contains data
preservation. Following the EU discussions on data retention, though, a
number of countries including Nigeria, Estonia, and Argentina have adopted
data retention laws. Peter Swire from Ohio State University, the former
Clinton Administration’s Chief Counselor for Privacy, introduced a new way
of framing the debate on data retention. It is not just a cost argument
that helps to align with industry, but also a security risk. If all
Internet traffic data are retained, Internet usage of police officers and
security agencies will also be retained. Therefore, organised crime no
longer has to bribe police officers in order to get inside information,
but just needs to bribe ISP employees. This led to an interesting
discussion on the security risks related to data retention. In the end,
the most appealing argument was that not even the Bush administration
agencies want data retention in their “war on terrorism”.

The panel on biometrics started with the assumption by Gus Hosein from
co-organiser Privacy International that these technologies are already
here and can not be stopped anymore. Therefore, civil liberty groups have
to come up with more realistic approaches. The Swiss Data Protection
Commissioner Hanspeter Thür then presented his approach to biometrics.
Different from the EU rush, Switzerland started a pilot project before
deciding about the introduction of biometric passports. The DPA’s biggest
concern at the moment is the plan for a central national database for
biometric passports. A plan for such a database for immigration control
has already been stopped by the DPA. Barry Steinhardt from co-organiser
ACLU pointed out the governments’ “policy laundering” strategy, where they
introduced biometric passports through the mostly unknown and
in-transparent organisation ICAO and then at the national level referred
to “international obligations”. Stephanie Perrin from the Office of the
Canadian Federal Data Protection Commissioner gave some examples of how to
and how not to fight biometrics. The “it does not work” argument is
tricky, because many of the technologies will work in a few years. More
successful are early privacy impact assessments that are mandatory in
Canada and a focus on standards organisations. The biggest problem and
concern in biometrics is the creation of central databases, the
participants agreed after also discussing security aspects in this field.

EDRI likes to thank EDRI-member Swiss Internet User Group (SIUG) and the
Swiss coalition Communica-ch for taking care of the local arrangements and
funding for this event.

Agenda of EDRI pre-event in Montreux (12.09.2005)
http://www.edri.org/panels

(Contribution by Ralf Bendrath, EDRI member Netzwerk Neue Medien and chair
of the data retention panel)