Social media and Big Data
Alessandro Mantelero; Giuseppe Vaciago
Abstract
Social media create a peculiar technological landscape in which the predictive ability that distinguishes Big Data has relevant impact in terms of implementation of social surveillance systems. Moreover, the modern social surveillance is no longer realized only by intelligence apparatus, but it is the result of the interplay between private and public sectors, based on a collaborative model made possible by mandatory disclosure orders issued by courts or administrative bodies and extended to an undefined pool of collaborations from big companies.
The aim of the authors is to suggest possible legal and policy solutions to boost a more democratic access to information and to protect individual and collective freedoms.
To reach this goal, the new European proposal on data protection indirectly increases the control over Big Data owners, in order to limit potential abuses and illegitimate advantages, as well as to prevent and limit access to European citizens’ data.
Introduction
Social media represent an increasing and fundamental part of the online environment generated by the Web 2.0, in which the users are authors of the contents and do not receive passively information, but they create, reshape and share it. In some cases, the interaction among users based on social media created communities, virtual worlds (e.g., Second Life, World of Warcraft) or crowdsourcing projects (Wikipedia). Although there are significant differences in the nature of these outputs, two aspects are always present and are relevant in the light of this contribution: large amount of information, user generated contents.
The social media platforms aggregate huge amounts of data generated by users, which are in many cases identified or identifiable (Ohm, 2010; United States General Accounting Office, 2011; See also Zang and Bolot, 2011; Golle, 2006; Sweeney, 2000b; Sweeney, 2000a; Tene and Polonetsky, 2013).1 This contributes to create a peculiar technological landscape in which the predictive ability that distinguishes Big Data (The Aspen Institute, 2010; Boyd and Crawford, 2011; see also Marton et al., 2013)2 has relevant impact not only in terms of competitive advantage in the business world (identifying in advance emerging trends, business intelligence, etc.) but also in terms of implementation of social surveillance systems by states and groups of power.
From this perspective, the following pages consider these phenomena of concentration of digital information and related asymmetries, which put in the hands of few entities a large amount of data, facilitating the attempts of social surveillance by governments and private companies. The aim of this chapter is to suggest some possible legal and policy solutions both to boost a more democratic access to information and to protect individual and collective freedom.
Big Data: The Asymmetric Distribution of Control Over Information and Possible Remedies
Big Data is not something new, but currently at the final stage of a long evolution of the capability to analyze data using computer resources. Big Data represents the convergence of different existing technologies that permit enormous data-centers to be built, create high-speed electronic highways and have ubiquitous and on-demand network access to computing resources (cloud computing). These technologies offer substantially unlimited storage, allow the transfer of huge amounts of data from one place to another, and allow the same data to be spread in different places and re-aggregated in a matter of seconds.
All these resources permit a large amount of information from different sources to be collected and the petabytes of data generated by social media represent the ideal context in which Big Data analytics can be used. The whole dataset can be continuously monitored by analytics, in order to identify the emerging trends in the flows of data and obtaining real-time or nearly real-time results in a way that is revolutionary and differs from the traditional sampling method (The Aspen Institute, 2010).
The availability of these new technologies and large datasets gives a competitive advantage to those who own them in terms of capability to predict new economic, social and political trends.
In the social media context, these asymmetries are evident with regard to the commercial platforms (e.g., Twitter, Google +, etc.), in which the service providers play a substantial role in term of control over information. Conversely, when the social media are based on open, decentralized and participative architectures, these asymmetries are countered; for this reason in the following paragraphs we will consider the role assumed by open architectures and open data in order to reach a wider access to information and a lower concentration of control over information.
In order to control and limit the information asymmetries related to Big Data and their consequences, in terms of economic advantages and social control, it seems to be necessary the adoption of various remedies, as the complexity of the phenomenon requires different approaches.
First of all, it is important to achieve a better allocation of the control over information. For this purpose, it is necessary to adopt adequate measures to control those who have this power, in order to limit possible abuses and illegitimate advantages. At the same time, we need to increase access to the information and the number of subjects able to create and manage large amounts of data, spreading the informational power currently in the hands of a few bodies.
The need to control these great aggregations of data is also related to their political and strategic relevance and should lead the introduction of a mandatory notification of the creation of a big and important database—as happened at the beginning of the computer age when there was a similar concentration of power in the hands of a few subjects due to the high cost of the first mainframes (Article 29 Data Protection Working Party, 2005; Article 29 Data Protection Working Party, 1997; Bygrave, 2002)3—and the creation of specific international independent authorities. These authorities will be able to control the invasive attitude of governmental power with regard to large databases and the power of the owner of Big Data, but can also have an important role in the definition of specific standards for data security.
This will be a long and tortuous journey, as it is based on international cooperation; nevertheless, it is important to start it as soon as possible, using the existing international bodies and multilateral dialogues between countries. At the same time, any solutions should be graduated in an appropriate manner, avoiding the involvement of every kind of data-farm built somewhere in the world, but considering only the data-farms with an absolutely remarkable dimension or a considerable importance because of the data collected (e.g., police or military databases).
Access to data and data sharing are other two central aspects that should be considered in order to limit the power of the owners of Big Data and give society the opportunity to have access to knowledge. From this perspective, a key role is played by open data (Veenswijk et al., 2012; Executive Office of the President, National Science and Technology Council, 2013)4 and the above-mentioned policies about transparency of the information society (i.e., notification), which permit to know who holds great informational power and ask to these entities to open their archives.
Opening public databases and potentially private archives (Deloitte, 2012; Enel, 2013; Nike Inc., 2013; ASOS API project, 2013; Canadian Goldcorp Inc., 2013) to citizens and giving them raw data not only reduces the power of the owners of information, in terms of the exclusive access to the data, but also limits their advantage in terms of technical and cultural analysis skills (Open Knowledge Foundation, 2004; Cyganiak and Jentzsch, 2011; Kroes, 2011).5
Finally, it is necessary to address the critical issues concerning the geopolitical distribution of informational power, which represents an emerging problem for Europe. Even though big European companies are able to collect and analyze a large amount of data, the main commercial social media are based in U.S. and this element puts this nation in a better position to control the world's informational flows generated by the users of these kinds of services.
From a geo-political perspective, this situation represents a weakness for the E.U., in terms of the loss of control over the data of its citizens due to the need to entrust the management of strategic information to foreign entities. In order to reduce this risk, the European industry is being urged to assume a more important role in ICT sector (Kroes, 2011) and, at the same time, the E.U. is strengthening the protection of personal data.
Big Data and Social Surveillance: Public and Private Interplay in Social Control
The risks related to the concentration of the control over information in the social media context and in general are not restricted to the democratic access and distribution of information and knowledge, but also to the potential systems of social surveillance that can be realized using this information.
From this perspective, the recent NSA case (European Parliament, 2013c; Auerbach et al., 2013; European Parliament, 2013a; European Parliament, 2013b)6 is being the more evident representation of the potential consequences of monitoring online interaction, although it is just the latest in a series of programs adopted by governmental agencies in various nations to pursue massive social surveillance (European Parliament, 2001; European Parliament 2013a; European Parliament 2013b; DARPA. Total Information Awareness Program (TIA), 2002; National Research Council, 2008; Congressional Research Service. CRS Report for Congress, 2008).7
In western democratic nations, the modern social surveillance is no longer realized only by intelligence apparatus, which autonomously collects a huge amount of information through pervasive monitoring systems. The social surveillance is the result of the interaction between the private and public sector, based on a collaborative model made possible by mandatory disclosure orders issued by courts or administrative bodies and extended to an undefined pool of voluntary or proactive collaborations from big companies (Council of Europe, 2008).
In this way, governments obtain information with the indirect “co-operation” of the users who probably would not have given the same information to public entities if requested. Service providers, for example, collect personal data on the base of private agreements (privacy policies) with the consent of the user and for their specific purposes (Reidenberg, 2013) but governments exploit this practice by using mandatory orders to obtain the disclosure of this information. This dual mechanism hides from citizens the risk and the dimension of the social control that can be realized by monitoring social networks or other services and using Big Data analytics technologies.
Another relevant aspect of the control deriving from Big Data is the amount of it. Analyses focused on profiling enable to predict the attitudes and decisions of any single user and even to match similar profiles. In contrast, Big Data is not used to focus on individuals, but to analyze large groups and populations (e.g., the political sentiment of an entire country).
Although, in many cases, intelligence activities have little to do with general data protection regulations—since they are authorized by specific legislative provisions introducing exceptions to general principles (Cate et al., 2012; Swire, 2012; Bailey, 2012; Wang, 2012; Brown, 2012; Tsuchiya, 2012; Pell, 2012; Cate and Cate, 2012; Svantesson, 2012; Tene, 2012; Schwartz, 2012; Abraham and Hickok, 2012; See also Brown, 2013; European Parliament, 2013b), regulations on data protection and privacy can play a relevant role in terms of reduction of the amount of data collected by private entities and, consequently, have an indirect impact on the information available for purposes of public social surveillance.
The interaction between public and private in social control could be divided in two categories, both of which are significant with regard to data protection. The first concerns the collection of private company data by government and judicial authorities (see Section “Array of Approved eSurveillance Legislation”), whilst the second is the use by government and judicial authorities of instruments and technologies provided by private companies for organizational and investigative purposes (see Section “Use of Private Sector Tools and Resources”).
Array of Approved eSurveillance Legislation
With regard to the first category and especially when the request is made by governmental agencies, the issue of the possible violation of fundamental rights becomes more delicate. The Echelon Interception System (European Parliament, 2001) and the Total Information Awareness (TIA) Program (European Parliament, 2001; European Parliament 2013a; European Parliament 2013b; DARPA. Total Information Awareness Program (TIA), 2002; National Research Council, 2008; Congressional Research Service. CRS Report for Congress, 2008) are concrete examples which are not isolated incidents, but undoubtedly the NSA case (European Parliament, 2013c; Auerbach et al., 2013; European Parliament, 2013a; European Parliament, 2013b)8 has clearly shown how could be invasive the surveillance in the era of global data flows and Big Data. To better understand the case, it’s quite important to have an overview of the considerable amount of electronic surveillance legislation which, particularly in the wake of 9/11, has been approved in the United States and, to a certain extent, in a number of European countries.
The most important legislation is the Foreign Intelligence Surveillance Act (FISA) of 19789 which lays down the procedures for collecting foreign intelligence information through the electronic surveillance of communications for homeland security purposes. The section 702 of FISA Act amended in 2008 (FAA) extended its scope beyond interception of communications to include any data in public cloud computing as well. Furthermore, this section clearly indicates that two different regimes of data processing and protection exist for U.S. citizens and residents (USPERs) on the one hand, and non-U.S. citizens and residents (non-USPERs) on the other. More specifically the Fourth Amendment is applicable only for U.S. citizens as there is an absence of any cognizable privacy rights for “non-U.S. persons” under FISA (Bowden, 2013).
Thanks to FISA Act and the amendment of 2008, U.S. authorities have the possibility to access and process personal data of E.U. citizens on a large scale via, among others, the National Security Agency’s (NSA) warrantless wiretapping of cable-bound internet traffic (UPSTREAM) and direct access to the personal data stored in the servers of U.S.-based private companies such as Microsoft, Yahoo, Google, Apple, Facebook or Skype (PRISM), through cross-database search programs such as X-KEYSCORE. U.S. authorities have also the power to compel disclosure of cryptographic keys, including the SSL keys used to secure data-in-transit by major search engines, social networks, webmail portals, and Cloud services in general (BULLRUN Program) (Corradino, 1989; Bowden, 2013). Recently the United States President’s Review Group on Intelligence and Communications Technologies released a report entitled “Liberty and Security in a Changing World.” The comprehensive report sets forth 46 recommendations designed to protect national security while respecting our longstanding commitment to privacy and civil liberties with a specific reference to on non-U.S. citizen (Clarke et al., 2014).
Even if the FISA Act is the mostly applied and known legislative tool to conduct intelligence activities, there are other relevant pieces of legislation on electronic surveillance. One need only to consider the Communications Assistance For Law Enforcement Act (CALEA) of 1994,10 which authorizes the law enforcement and intelligence agencies to conduct electronic surveillance by requiring that telecommunications carriers and manufacturers of telecommunications equipment modify and design their equipment, facilities, and services to ensure that they have built-in surveillance. Furthermore, following the Patriot Act of 2001, a plethora of bill has been proposed. The most recent bills (not yet in force) are the Cyber Intelligence Sharing and Protection Act (CISPA) of 2013 (Jaycox and Opsahl, 2013), which would allow Internet traffic information to be shared between the U.S. government and certain technology and manufacturing companies and the Protecting Children From Internet Pornographers Act of 2011,11 which extends data retention duties to U.S. Internet Service Providers.
Truthfully, the surveillance programs are not only in the United Sattes. In Europe, the Communications Capabilities Development Program has prompted a huge amount of controversy, given its intention to create a ubiquitous mass surveillance scheme for the United Kingdom (Barret, 2014) in relation to phone calls, text messages and emails and extending to logging communications on social media. More recently, on June 2013 the so-called program TEMPORA showed that UK intelligence agency Government Communications Headquarters (GCHQ) has cooperated with the NSA in surveillance and spying activities (Brown, 2013).12 These revelations were followed in September 2013 by reports focusing on the activities of Sweden’s National Defense Radio Establishment (FRA). Similar projects for the large-scale interception of telecommunications data has been conducted by both France’s General Directorate for External Security (DGSE) and Germany’s Federal Intelligence Service (BDE) (Bigo et al., 2013).
Even if it seems that E.U. and U.S. surveillance programs are similar, there is one important difference: In the E.U., under Data Protection law, individuals have always control of their own personal data while in U.S., the individual have a more limited control once the user has subscribed to the terms and condition of a service.13
Forced “On Call” Collaboration by Private Entities
Other than government agencies' monitoring activities, there are cases in which Internet Service Providers collaborate spontaneously or over a simple request from the law enforcement agencies. The exponential increase in Big Data since 2001 has provided a truly unique opportunity. In this respect, a key role has been played by Social Media. One need only reflect on the fact that Facebook, Twitter, Google +, and Instagram, all of which are situated in Silicon Valley, boast around 2 billion users throughout the world14 and many of these users are citizens of the European Union. Facebook's founder may have intended “to empower the individual,” but there is no doubt that Social Network Services (SNSs) have also empowered law enforcement (Kirkpatrick, 2013).
Data Collection for Crime Prediction and Prevention
To stay on the topic of information acquisition by the law enforcement, there are two interesting cases of the collection of Big Data for crime prevention purposes:
The first is the “PredPol” software initially used by the Los Angeles police force and now by other police forces in the United States (Palm Beach, Memphis, Chicago, Minneapolis and Dallas). Predictive policing, in essence, cross check data, places and techniques of recent crimes with disparate sources, analyzing them and then using the results to anticipate, prevent and respond more effectively to future crime. Even if the software house created by PredPol declares that no profiling activities are carried out, it becomes essential to carefully understand the technology used to anonymize the personal data acquired by the law enforcement database. This type of software is bound to have a major impact in the United States on the conception of the protection of rights under the Fourth Amendment, and more specifically on concepts such as “probable cause” and “reasonable suspicion” which in future may come to depend on an algorithm rather than human choice (Ferguson, 2012).
The second example is X1 Social Discovery software.15 This software maps a given location, such as a certain block within a city or even an entire particular metropolitan area, and searches the entire public Twitter feed to identify any geo-located tweets in the past three days (sometimes longer) within that specific area. This application can provide particularly useful data for the purpose of social control. One can imagine the possibility to have useful elements (e.g., IP address) to identify the subjects present in a given area during a serious car accident or a terrorist attack.
Legitimacy
From a strictly legal standpoint, these social control tools may be employed by gathering information from citizens directly due the following principle of public:
“Where someone does an act in public, the observance and recording of that act will ordinarily not give rise to an expectation of privacy”.
In the European Union, whilst this type of data collection frequently takes place, it could be in contrast with ECHR case law which, in the Rotaru vs. Romania case,16 ruled that “public information can fall within the scope of private life where it is systematically collected and stored in files held by the authorities.” As O’Floinn observes: “Non-private information can become private information depending on its retention and use. The accumulation of information is likely to result in the obtaining of private information about that person” (O’Floinn and Ormerod, 2001).
In the United States, this subject has been addressed in the case People vs. Harris,17 currently pending in front of the Supreme Court. On January 26, 2012, the New York County District Attorney’s Office sent a subpoena to Twitter, Inc. seeking to obtain the Twitter records of user suspected of having participated in the “Occupy Wall Street” movement. Twitter refused to provide the law enforcement officers with the information requested and sought to quash the subpoena. The Criminal Court of New York confirmed the application made by the New York County District Attorney’s Office, rejecting the arguments put forward by Twitter, stating that tweets are, by definition, public, and that a warrant is not required in order to compel Twitter to disclose them. The District Attorney’s Office argued that the “third party disclosure” doctrine put forward for the first time in United States vs. Miller was applicable.18
Use of Private Sector Tools and Resources
The second relationship concerns the use by the state of tools and resources from the private company for the purposes of organization and investigations. Given the vast oceans of Big Data, U.S. governmental authorities decided to turn to the private sector, not only for purposes of software management but also in relation to management of the data itself. One example is the CTO’s Hadoop platform (CTO labs, 2012), which is capable of memorizing and storing data in relation to many law enforcement authorities in the United States. Similarly, a private cloud system has emerged which conveys the latest intelligence information in near-real time to U.S. troops stationed in Afghanistan (Conway, 2014). Another example is the facial recognition technology developed by Walt Disney for its park and sold to the U.S. military force (Wolfe, 2012).
Considering costs saving and massive computing power of a centralized cloud system, it is inevitable that law enforcement, military forces and government agencies will progressively rely on this type of services. The afore-mentioned change will entail deducible legal issues in terms of jurisdiction, security and privacy regarding data management. The relevant legal issues might be solved through a private cloud within the State with exclusive customer key control. However, it is worth considering that, in this way, private entities will gain access to a highly important and ever expanding information asset. Therefore, they will be able to develop increasingly sophisticated and data mining tools, thanks to cloud systems’ potential. This scenario, which is already a fact in the United States, might become reality also thanks to the impulse of the Digital Agenda for Europe and its promotion of Public Private Partnership initiatives on Cloud (Commission of the European Communities, 2009; see also The European Cloud Partnership (ECP), 2013). This is why it is important that European cloud services should be based on high standards of data protection, security, interoperability and transparency about service levels and government access to information as it has recently been recognized by the European Commission (European Commission, 2013).
The Role of the E.U. Reform on Data Protection in Limiting the Risks of Social Surveillance
The framework described above shows that modern social control is the result of the interaction between the private and public sector. This collaborative model is not only based on mandatory disclosure orders issued by courts or administrative bodies, but has also extended to a more indefinite grey area of voluntary and proactive collaboration by big companies. It is difficult to get detailed information on this second model of voluntary collaboration; however, the predominance of U.S. companies in the ICT sector, particularly with regard to the Internet and cloud services, increases the influence of the U.S. administration on national companies and makes specific secret agreements of cooperation in social control easier (European Parliament, 2013a; European Parliament, 2012).
Against this background, the political and strategic value of the European rules on data protection emerges. These rules may assume the role of a protective barrier in order to prevent and limit access to the information about European citizens.19 In this sense, the E.U. Proposal for a General Data Protection Regulation (European Commission, 2012) extends its territorial scope (Article 3 (2), 2013) through “the processing of personal data of data subjects in the Union by a controller or processor not established in the Union, where the processing activities are related to:
(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
(b) the monitoring of such data subjects”.20
It should be noted that various commentators consider that the privacy risks related to Big Data analytics are low, pointing out the large amount of data processed by analytics and the de-identified nature of most of this data. This conclusion is wrong. Anonymity by de-identification is a difficult goal to achieve, as demonstrated in a number of studies (see Ohm, 2010; United States General Accounting Office, 2011; See also Zang and Bolot, 2011; Golle, 2006; Sweeney, 2000b; Sweeney, 2000a; Tene and Polonetsky, 2013). The power of Big Data analytics to draw unpredictable inference from information undermines many strategies based on de-identification (Mayer-Schönberger and Cukier, 2013; Schwartz and Solove, 2011). In many cases a reverse process in order to identify individuals is possible; it is also possible to identify them using originally anonymous data (see Ohm, 2010; United States General Accounting Office, 2011; See also Zang and Bolot, 2011; Golle, 2006; Sweeney, 2000b; Sweeney, 2000a; Tene and Polonetsky, 2013). Here, it is closer to the truth to affirm that each data is a piece of personal information than to assert that it is possible to manage data in a de-identified way.
Although the Proposal for a new regulation does not regard the data processed by public authorities for the purposes of prevention, investigation, detection, prosecution of criminal offences or the execution of criminal penalties,21 its impact on social control is significant, since in many cases the databases of private companies are targeted by public authority investigations. For this reason, reducing the amount of data collected by private entities and increasing data subjects' self-determination with regard to their personal information limit the possibility of subsequent social control initiatives by government agencies.
However, the complexity of data processes and the power of modern analytics along with the presence of technological and market lock-in effects drastically reduce the awareness of data subjects, their capability to evaluate the various consequences of their choices and the expression of a real free and informed consent (Brandimarte et al., 2010). This lack of awareness facilitates the creation of wider databases, which are accessible by the authorities in cases provided by the law, and is not avoided by giving adequate information to the data subjects or by privacy policies, due to the fact that these notices are read only by a very limited number of users who, in many cases, are not able to understand part of the legal terms usually used in these notices (Turow et al., 2007).
These aspects are even more relevant in a Big Data context rendering the traditional model of data protection to be in crisis (Cate, 2006; See also Cate and Mayer-Schönberger, 2012; Rubinstein, 2013). The traditional model is based on general prohibition plus “notice and consent”22 and the coherence of the data collection with the purposes defined at the moment in which the information is collected. However, nowadays much of the value of personal information is not apparent when notice and consent are normally given (Cate, 2006; See also Cate and Mayer-Schönberger, 2012; Rubinstein, 2013) and the “transformative” (Tene and Polonetsky, 2012) use of Big Data makes it often impossible to explain the description of all its possible uses at the time of initial collection.
The E.U. Proposal, in order to reinforce the protection of individual information, interacts with these constraints and shifts the focus of data protection from an individual choice toward a privacy-oriented architecture (Mantelero, 2013a).23 This approach, which limits the amount of data collected through “structural” barriers and introduces a preventive data protection assessment (Article 23, 2013), also produces a direct effect on social control by reducing the amount of information available.
With regard to the information collected, the E.U. Proposal reinforces users' self-determination by requiring data portability, which gives the user the right to obtain a copy of the data undergoing processing from the controller “in an electronic and structured format which is commonly used and allows for further use by the data subject”.24 Portability will reduce the risk of technological lock-in due to the technological standards and data formats adopted by service providers, which limit the migration from one service to another. However, in many cases and mainly in social media context, the limited number of companies providing the services reduces the chances for users not to be tracked by moving their account from one platform to another and, thereby, minimizes the positive effects of data portability.
Finally, the Proposal reinforces the right to obtain the erasure of data processed without the consent of the data subject, against his objection, without providing adequate information for him or outside of the legal framework (Mantelero, 2013b). An effective implementation of this right can reduce the overall amount of data stored by service providers, and may limit the amount of information existing in the archives without a legitimate reason for the processing of information. In this manner, the possibility of consulting the history of individual profiles by authorities is also reduced.
All the aspects considered above concur to limit the information available to all entities interested in social control, and therefore, also affect the request of disclosure held by government agencies and courts to private companies. Nevertheless, these powers of search and seizure and their exercise represent the fundamental core of social control.
Preserving the E.U. Data Protection Standard in a Globalized World
In order to analyze this aspect in the scenario of the future European data protection framework it is necessary to consider both proposals by the European Commission:
- the Proposal for a new General Data Protection Regulation (PGDPR) (see European Commission, 2012) and
- the less debated Proposal for a Directive in the law enforcement sector (PDPI).25
Although the second proposal is more specific on governmental and judicial control, the first considers this aspect from the point of view of the data flows.
The new Proposal for a new General Data Protection Regulation, as well as the currently in force Directive 96/46/EC, allows trans-border data flows from the Europe to other countries only when the third country provides an adequate level of data protection (Mantelero, 2012). When evaluating the adequacy of data protection in a given country, the Commission should also consider to the legislation in force in third countries “including concerning public security, defense, national security and criminal law”.26 Consequently, the presence of invasive investigative public bodies and the lack of adequate guarantees to the data subject assume relevance for the decision whether to limit the trans-border data flows between subsidiaries and holdings or between companies. Once again this limit does not affect public authorities, but restricts the set of information held by private companies available for their scrutiny.
Without considering the NSA case that is still on-going, an explanatory case on the relationship between trans-border data flows, foreign jurisdiction and the possible effects on citizens and social control is provided by the SWIFT case; the same criticism applies and has been expressed by commentators with regard to the U.S. Patriot Act. These two cases differ because in the NSA case non-E.U. authorities requested to access information held by a company based in the E.U., whereas in the SWIFT case the requests were directed to U.S. companies in order to have access to the information they received from their E.U. subsidiaries.
In the SWIFT case (Article 29 Data Protection Working Party, 2006b) the Article 29 Data Protection Working Party clarified that a foreign law does not represent the legal base for the disclosure of personal information to non-E.U. authorities, since only the international instruments provide an appropriate legal framework enabling international cooperation (Article 29 Data Protection Working Party, 2006b; see also Article 29 Data Protection Working Party, 2006a). Furthermore, the exception provided by Art. 26 (1) (b) Directive 95/46/EC27 does not apply when the transfer is not necessary or legally required on important public interest grounds of an E.U. Member State (Article 29 Data Protection Working Party, 2006b).28
In contrast (as emerged in the PATRIOT Act case and also with reference to the wider, complex and dynamic system of powers enjoyed by the U.S. government in the realm of criminal investigations and national security (van Hoboken et al., 2012)29), the U.S. authorities may access data held by the E.U. subsidiaries of U.S. companies.30 However, it is necessary to point out that there is a potential breach of protection of personal data of European citizens and that this happens not only with regards to U.S. laws, but also in relations with other foreign regulations, as demonstrated by the recent draft of the Indian Privacy (Protection) Bill31 and Chinese laws on data protection (Greenleaf and Tian, 2013; The Decision of the Standing Committee of the National People’s Congress on Strengthening Internet Information Protection 2012; Ministry of Industry and Information Technology Department Order, 2011; Greenleaf, 2013).
In order to reduce such intrusions the draft version of the E.U. Proposal for a General Data Protection Regulation limited the disclosure to foreign authorities and provided that
“no judgment of a court or tribunal and no decision of an administrative authority of a third country requiring a controller or processor to disclose personal data shall be recognized or be enforceable in any manner, without prejudice to a mutual assistance treaty or an international agreement in force between the requesting third country and the Union or a Member State”.32
The draft also obliged controllers and processors to notify national supervisory authorities of any such requests and to obtain prior authorization for the transfer by the supervisory authority (See also European Parliament, 2013c; European Parliament, 2013a; European Parliament, 2013b).33 These provisions had been dropped from the final version of the Commission’s Proposal on 25 January 2012, but have now been reintroduced by the European Parliament, as a reaction to the NSA case.34
In addition to the Proposal for a General Data Protection Regulation, the above-mentioned Proposal for a Directive on the protection of individuals with regard to the processing of personal data by competent authorities (PDPI) establishes some protection against a possible violation of EU citizens' privacy.
The goal of this Directive is to ensure that “in a global society characterized by rapid technological change where information exchange knows no borders” the fundamental right to data protection is consistently protected.35 One of the main issues at E.U. level is the lack of harmonization across Member States’ data protection law and even more “in the context of all E.U. policies, including law enforcement and crime prevention as well as in our international relations” (European Commission, 2010). Whilst a directive may not have the same impact on harmonizing national regulations currently in force in various Member States (For a critical view on this point see Cannataci, 2013; See also Cannataci and Caruana, 2014), it does in fact represent the first piece of legislation to have direct effect when compared to the previous attempts by way of Council of Europe Recommendation No. R (87)36 and Framework Decision 2008/977/JHA.37
The founding principles of this Directive, which are shared with the previous directives referred to, are twofold:
(1) First there is the need for fair, lawful, and adequate data processing during criminal investigations or to prevent a crime, on the basis of which every data must be collected for specified, explicit and legitimate purposes and must be erased or rectified without delay (Art. 4, PDPI and Art. 4b, 2013).
(2) Then there is the obligation to make a clear distinction between the various categories of the possible data subjects in a criminal proceeding (persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence, persons convicted, victims of criminal offense, third parties to the criminal offence).
For each of these categories there must be a different adequate level of attention on data protection, especially for persons who do not fall within any of the categories referred above.38
These two principles are of considerable importance, although their application on a practical level will be neither easy nor immediate in certain Member States. This is easily demonstrated by the difficulties encountered when either drafting practical rules distinguishing between several categories of potential data subjects within the papers on a court file, or attempting to identify the principle on the basis of which a certain court document is to be erased.
In addition to these two general principles the provisions of the Directive, are interesting and confirm consolidated data protection principles. Suffice to mention here the prohibition on using measures solely based on automated processing of personal data which significantly affect or produce an adverse legal effect for the data subject,39 as well as the implementation of data protection by design and by default mechanisms to ensure the protection of the data subject’s rights and the processing of only those personal data.40
Furthermore, the proposal for a Directive in the law enforcement sector entails the obligation to designate a data protection officer in all law enforcement agencies in order to monitor the implementation and application of the policies on the protection of personal data.41
These principles constitute a significant limitation to possible data mining of personal and sensitive data collection by law enforcement agencies. If it is true that most of these provisions were also present in the Recommendation No. R (87) of Council of Europe and in the Framework Decision 2008/977/JHA, it is also true that propelling data protection by design and by default mechanisms and measures could encourage data anonymization and help to avoid the indiscriminate use of automated processing of personal data.