A variety of client and professional meetings in France and Belgium have me here for an extended stay. I have heard many interesting things about privacy and data protection issues. So here is what I am hearing "out on the Rue."

The outcome of the EU regulation is anyone’s guess

One senior representative of an American multinational corporation predicted that the concerns of countries like France and Germany about the weakening of local control over data protection rules will result in the Council of the European Union—where national ministers from each EU country meet to adopt laws and coordinate policies along with the European Parliament—will push for conversion of the regulation into a new Data Protection Directive empowering new national legislation. When asked about that possibility, a well-placed source at the CNIL flatly dismissed that possibility and predicted that the regulation currently under consideration will in fact be adopted. A less optimistic view about the progress of the regulation came from a counselor in the French Ministry focused on innovation and data who expressed concern about the vast number of unresolved issues in the regulation, as well as the multiple delegated acts, and the postponement of the parliamentary final report on the proposed regulation.

U.S. NGO suggestion on narrowing the scope of the “right to be forgotten” is well-received

A recent blog post by Center for Democracy and Technology President Leslie Harris entitled “How to Fix the EU's 'Right to Be Forgotten'” describes an amendment that would have the right to be forgotten only cover personal data that a data subject has provided. Harris explained: “This narrowing is critical to promote the data subject's ability to call for the takedown of data she has stored with or provided to an online service, while avoiding a rule that burdens other users' free expression rights.” A number of EU privacy professionals I spoke with welcomed the proposed narrowing and indicated they would be supportive of such an amendment. They also praised the effort by someone in the U.S. to offer constructive advice on the regulation “rather than simply criticizing the regulation,” as one observer stated.

Misunderstanding about U.S. governmental access to data in the cloud is addressed in new whitepaper

At programs presented by the Openforum Academy in Brussels on 22 May, and by the French-American Chamber of Commerce in Paris on 23 May, Hogan Lovells released a whitepaper with the results of a study about governmental access to data in the cloud. I wrote the paper with my Paris office partner Winston Maxwell.

This whitepaper debunks the frequently expressed assumption that the U.S. is alone in permitting governmental access to data for national security or foreign intelligence reasons. It examines the laws of six countries, including the U.S., with respect to governmental authorities’ ability to access data stored in or transmitted through the cloud, and documents the similarities and differences among the various legal regimes. The whitepaper—which follows our 2012 whitepaper on addressing governmental access to data in the cloud for general law enforcement purposes—reveals that every jurisdiction examined vests authority in the government to require a cloud service provider to disclose customer data for national security or foreign intelligence reasons.

The whitepaper also reveals that, unlike in the U.S. where the law specifically protects cloud data from access by the government without legal process, data stored in the cloud may be disclosed to governmental authorities voluntarily in some jurisdictions, without legal process and protections.

As we said in the whitepaper, our review reveals that businesses are misleading themselves and their customers if they contend that restricting cloud service providers to one jurisdiction better insulates data from governmental access. It is incorrect to assume that the U.S. government’s access to data in the cloud is greater than that of other advanced economies.

Despite the passionately stated views of one Brussels attendee, who doubted that U.S. officials were following the law—and who expressed similar previous doubts about UK officials—those discussing the whitepaper, including a representative of the CNIL, acknowledged that governmental access to data in the cloud is by no means a unique U.S. phenomenon. The Paris program prompted a lively discussion of the extent of national jurisdiction to control Internet actors, with a particular discussion of a case involving Twitter where a French court ordered the unmasking of a Twitter user.

Efficacy of traditional privacy framework in dealing with Big Data and Internet of Things questioned

I was present at the International Forum on International Privacy Law for a lively discussion of the difficulty of applying Fair Information Practice Principles to new technological advances involving Big Data and the Internet of Things. While the “Chatham House Rule” prevents identification of the speaker, one senior privacy professional spoke adamantly—in the presence of a senior EU regulator—about the unworkability of concepts like consent, purpose specification, access and data minimization with various new technologies. A number of privacy professionals in attendance expressed agreement with that observation and suggested that accountability mechanisms and use restrictions were a possible approach.

The link between privacy and trade beginning to be recognized

As negotiations are about to begin on the Transatlantic Trade and Investment Partnership, discussions about the link between privacy and trade are beginning. Most EU officials with whom I spoke expressed fear that any discussion of privacy in the trade context would mean a U.S. push to weaken EU standards. Similarly, some U.S. representatives in the EU spoke of a push by the EU to have the U.S. enact “EU-style laws."  When I explained that there is a “third way,” focused on interoperability, as previewed by the Coalition for Privacy and Free Trade, there did seem to be great receptivity to discussing privacy in a trade context among those with whom I spoke.

Need for privacy professionals in Europe to grow

A strategic planning meeting of privacy lawyers from across my law firm’s offices in the U.S. and the EU fostered a robust discussion of the expected increase in client demand for privacy/data protection legal services with or without the new regulation. With technologies using personal data on the rise, and greater demand for data by business, the consensus was that focused regulatory and enforcement activity in the EU, and around the world, can be expected.

photo credit: dhammza via photopin cc