0 00:00:00,000 --> 00:00:30,000 Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/91 Thanks! 1 00:00:09,130 --> 00:00:11,499 So again, now back to our talk 2 00:00:11,500 --> 00:00:13,599 with us today, we have a member of 3 00:00:13,600 --> 00:00:15,969 the EU parliament who is driving forward 4 00:00:15,970 --> 00:00:18,339 the struggle between lobbyists 5 00:00:18,340 --> 00:00:20,679 of data collection corporations 6 00:00:20,680 --> 00:00:23,169 and citizens who are trying to find ways 7 00:00:23,170 --> 00:00:25,149 to secure their fundamental privacy 8 00:00:25,150 --> 00:00:27,219 rights. And he'll be talking to us 9 00:00:27,220 --> 00:00:29,529 today about that and some latest 10 00:00:29,530 --> 00:00:31,629 updates. So please help me welcome 11 00:00:31,630 --> 00:00:33,159 Jan Philipp Albert. 12 00:00:41,980 --> 00:00:43,569 Hi, thank you very much. 13 00:00:43,570 --> 00:00:45,699 First of all, for the nice welcome 14 00:00:45,700 --> 00:00:46,900 and thank you all for coming. 15 00:00:48,580 --> 00:00:49,539 I'm young, Philip. 16 00:00:49,540 --> 00:00:51,639 I wished I'm as announced 17 00:00:51,640 --> 00:00:53,499 a member of the European Parliament and 18 00:00:53,500 --> 00:00:55,449 I'm rapporteur for the General Data 19 00:00:55,450 --> 00:00:57,669 Protection Regulation. 20 00:00:57,670 --> 00:00:59,889 And today I want to talk about 21 00:00:59,890 --> 00:01:01,989 the European Data Protection Reform 22 00:01:01,990 --> 00:01:03,369 has EU data 23 00:01:04,420 --> 00:01:06,819 and the title 24 00:01:06,820 --> 00:01:09,159 State of the Union is chosen 25 00:01:09,160 --> 00:01:11,289 because I think that 26 00:01:11,290 --> 00:01:13,509 the data protection reform is 27 00:01:13,510 --> 00:01:16,449 one of the most important 28 00:01:16,450 --> 00:01:19,119 procedures of the European Union 29 00:01:19,120 --> 00:01:20,499 legislation. 30 00:01:20,500 --> 00:01:22,450 And I think that 31 00:01:24,250 --> 00:01:26,649 the question how it ends up 32 00:01:26,650 --> 00:01:29,199 and where it ends up is one of 33 00:01:29,200 --> 00:01:31,389 the most essential for the European 34 00:01:31,390 --> 00:01:32,390 Union's future. 35 00:01:35,440 --> 00:01:36,519 That's me. 36 00:01:36,520 --> 00:01:38,979 And you probably will 37 00:01:38,980 --> 00:01:40,659 never see me like that. 38 00:01:42,370 --> 00:01:44,529 I'm I have been a journalist, 39 00:01:44,530 --> 00:01:46,719 a lawyer and a politician, but most of 40 00:01:46,720 --> 00:01:49,329 my life I have been a politician. 41 00:01:49,330 --> 00:01:51,489 I'm representing the region here around 42 00:01:51,490 --> 00:01:53,529 Hamburg and the European Parliament, and 43 00:01:53,530 --> 00:01:55,689 I'm the lead negotiator for the European 44 00:01:55,690 --> 00:01:57,849 Parliament for the European Union's Data 45 00:01:57,850 --> 00:01:59,230 Protection Regulation, 46 00:02:01,300 --> 00:02:03,459 the European Union's data protection 47 00:02:03,460 --> 00:02:04,539 reform. 48 00:02:04,540 --> 00:02:06,249 So why do we need it? 49 00:02:06,250 --> 00:02:08,469 Why do we reform our data 50 00:02:08,470 --> 00:02:10,809 protection legislation in the European 51 00:02:10,810 --> 00:02:11,810 Union? 52 00:02:12,280 --> 00:02:14,649 First of all, we need to update 53 00:02:14,650 --> 00:02:16,899 the rules, which originate 54 00:02:16,900 --> 00:02:19,239 from nineteen ninety 55 00:02:19,240 --> 00:02:21,789 five so time. 56 00:02:21,790 --> 00:02:24,309 The legislative process was from 1990 57 00:02:24,310 --> 00:02:27,489 to 1995 or 1994, 58 00:02:27,490 --> 00:02:30,099 a process which is 59 00:02:30,100 --> 00:02:32,349 before the internet, as the mass 60 00:02:32,350 --> 00:02:35,799 media was existing 61 00:02:35,800 --> 00:02:38,289 in the minds of most people and 62 00:02:38,290 --> 00:02:39,290 before 63 00:02:40,810 --> 00:02:42,879 also politicians 64 00:02:42,880 --> 00:02:45,039 got aware of the internet. 65 00:02:45,040 --> 00:02:47,379 So these rules need to be adjusted. 66 00:02:48,430 --> 00:02:50,319 It doesn't mean that these rules from 67 00:02:50,320 --> 00:02:52,339 1995 are completely wrong. 68 00:02:52,340 --> 00:02:54,459 I think that the principles 69 00:02:54,460 --> 00:02:56,349 which are laid down laid down in the 70 00:02:56,350 --> 00:02:59,829 rules in the directive from 1995 71 00:02:59,830 --> 00:03:01,899 basically right. The principles and 72 00:03:01,900 --> 00:03:04,029 definitions, the idea, the 73 00:03:04,030 --> 00:03:06,429 concept of data protection. 74 00:03:06,430 --> 00:03:08,349 It was not the first time I would come to 75 00:03:08,350 --> 00:03:10,899 that where those rules were written down. 76 00:03:10,900 --> 00:03:13,449 So they are in principle, right? 77 00:03:13,450 --> 00:03:15,549 But obviously, those are 78 00:03:15,550 --> 00:03:18,279 not brought into practice 79 00:03:18,280 --> 00:03:20,079 for the internet environment, and we need 80 00:03:20,080 --> 00:03:22,779 to find new 81 00:03:22,780 --> 00:03:25,119 ways to interpret it to interpret 82 00:03:25,120 --> 00:03:27,099 these principles in the light of the 83 00:03:27,100 --> 00:03:28,779 digital age. 84 00:03:28,780 --> 00:03:32,109 Second, we need stricter enforcement, 85 00:03:32,110 --> 00:03:34,299 stricter enforcement because too 86 00:03:34,300 --> 00:03:37,269 today in today's situation, 87 00:03:37,270 --> 00:03:39,549 around 15 20 88 00:03:39,550 --> 00:03:41,679 years after this 89 00:03:41,680 --> 00:03:44,379 directive came into force, 90 00:03:44,380 --> 00:03:46,539 the enforcement of these rules 91 00:03:46,540 --> 00:03:47,979 is almost zero. 92 00:03:49,360 --> 00:03:51,429 That's my personal view, because in 93 00:03:51,430 --> 00:03:53,559 most of the situations of your 94 00:03:53,560 --> 00:03:55,809 data processing activities, wherever 95 00:03:55,810 --> 00:03:58,059 you are situated in the European 96 00:03:58,060 --> 00:04:00,919 Union, these rules are not 97 00:04:00,920 --> 00:04:03,399 of these processes 98 00:04:03,400 --> 00:04:05,199 are not going in accordance with the 99 00:04:05,200 --> 00:04:07,299 rules set out in 100 00:04:07,300 --> 00:04:09,369 these general EU 101 00:04:09,370 --> 00:04:11,469 rules and the rules which 102 00:04:11,470 --> 00:04:12,639 are applicable. 103 00:04:12,640 --> 00:04:14,829 Nobody really knows what they are if 104 00:04:14,830 --> 00:04:17,139 it's the Irish, the Swedish or 105 00:04:17,140 --> 00:04:19,539 the Austrian data protection 106 00:04:19,540 --> 00:04:20,679 law. 107 00:04:20,680 --> 00:04:23,289 And nobody really has a certain 108 00:04:23,290 --> 00:04:25,359 interpretation of what it means 109 00:04:25,360 --> 00:04:26,859 to apply these rules. 110 00:04:26,860 --> 00:04:29,619 So what we need is a better enforcement 111 00:04:29,620 --> 00:04:31,809 of these rules and 112 00:04:31,810 --> 00:04:33,849 especially one thing needs to be fixed. 113 00:04:33,850 --> 00:04:36,579 And that's closing the loopholes, 114 00:04:36,580 --> 00:04:39,399 loopholes and the meaning that 115 00:04:39,400 --> 00:04:41,289 in the internal market of the European 116 00:04:41,290 --> 00:04:43,749 Union, there have been 28 different 117 00:04:43,750 --> 00:04:45,129 data protection laws. 118 00:04:45,130 --> 00:04:47,259 This is a situation of today, 119 00:04:47,260 --> 00:04:49,059 and it opens up 120 00:04:50,500 --> 00:04:52,899 for companies to move 121 00:04:52,900 --> 00:04:55,329 where they see the least 122 00:04:56,440 --> 00:04:58,569 less regulation in Europe 123 00:04:58,570 --> 00:05:00,789 so they can just choose for the 124 00:05:00,790 --> 00:05:02,529 least protection for us. 125 00:05:02,530 --> 00:05:05,679 And that's a huge loophole 126 00:05:05,680 --> 00:05:07,119 forum shopping. 127 00:05:07,120 --> 00:05:09,729 And of course, in the interpretation 128 00:05:09,730 --> 00:05:11,649 of these laws and the implementation of 129 00:05:11,650 --> 00:05:13,449 international laws, there are quite a lot 130 00:05:13,450 --> 00:05:16,149 of loopholes because of very different 131 00:05:16,150 --> 00:05:18,759 wordings, very different interpretations 132 00:05:18,760 --> 00:05:21,130 by local or national courts. 133 00:05:22,510 --> 00:05:24,789 Then, of course, this leads to legal 134 00:05:24,790 --> 00:05:25,779 certainty. 135 00:05:25,780 --> 00:05:27,909 The question if we can trust in 136 00:05:27,910 --> 00:05:29,649 what the rules on data protection are 137 00:05:29,650 --> 00:05:32,079 about is one of the most important 138 00:05:32,080 --> 00:05:33,759 question not only for citizens and 139 00:05:33,760 --> 00:05:36,129 consumers, but also for business 140 00:05:36,130 --> 00:05:37,839 and for authorities. 141 00:05:37,840 --> 00:05:39,939 So legal certainty 142 00:05:39,940 --> 00:05:42,639 is the basis for 143 00:05:42,640 --> 00:05:44,739 a functioning rule of law system 144 00:05:44,740 --> 00:05:47,109 functioning, fundamental rights and rules 145 00:05:47,110 --> 00:05:49,179 for the markets and in the market. 146 00:05:49,180 --> 00:05:51,939 Of course, it's the most important 147 00:05:51,940 --> 00:05:53,169 trusts. 148 00:05:53,170 --> 00:05:55,809 Without trust, we will not get 149 00:05:55,810 --> 00:05:57,939 the development of 150 00:05:57,940 --> 00:06:00,339 technical, innovative 151 00:06:00,340 --> 00:06:02,649 formats, new data 152 00:06:02,650 --> 00:06:04,839 processing possibilities. 153 00:06:04,840 --> 00:06:07,179 We will have fall back into 154 00:06:07,180 --> 00:06:09,489 nationalization of the online 155 00:06:09,490 --> 00:06:11,589 environment and in 156 00:06:11,590 --> 00:06:13,809 blocking markets 157 00:06:13,810 --> 00:06:15,220 and closing markets. 158 00:06:16,900 --> 00:06:18,220 And then, of course, 159 00:06:19,240 --> 00:06:20,859 a data protection in Europe is a 160 00:06:20,860 --> 00:06:21,909 fundamental right. 161 00:06:21,910 --> 00:06:24,039 I will explain that in a minute. 162 00:06:24,040 --> 00:06:25,689 But safeguarding the fundamental right, 163 00:06:25,690 --> 00:06:28,539 of course, is one of the most important 164 00:06:28,540 --> 00:06:30,669 tasks for the European Union today. 165 00:06:30,670 --> 00:06:32,889 We need to have legislation which 166 00:06:32,890 --> 00:06:35,019 makes fundamental rights practical. 167 00:06:35,020 --> 00:06:37,959 Be enforceable 168 00:06:37,960 --> 00:06:38,960 and 169 00:06:40,090 --> 00:06:42,219 meaningful and not only 170 00:06:42,220 --> 00:06:44,139 written on the paper. 171 00:06:44,140 --> 00:06:46,899 And we need to set a standard 172 00:06:46,900 --> 00:06:49,089 by the EU and export it 173 00:06:49,090 --> 00:06:51,279 because data protection as a concept 174 00:06:51,280 --> 00:06:53,679 is something developed in Europe and 175 00:06:53,680 --> 00:06:56,319 something already 176 00:06:56,320 --> 00:06:58,299 implemented by quite a lot of states 177 00:06:58,300 --> 00:06:59,319 worldwide. 178 00:06:59,320 --> 00:07:01,449 But still, there's a huge gap 179 00:07:01,450 --> 00:07:03,969 and there is still a lack of 180 00:07:03,970 --> 00:07:06,099 acceptance for data protection 181 00:07:06,100 --> 00:07:07,599 as a fundamental right. 182 00:07:07,600 --> 00:07:09,729 And these standards, 183 00:07:09,730 --> 00:07:11,919 and on the global level, one 184 00:07:11,920 --> 00:07:13,929 example the United States, where you 185 00:07:13,930 --> 00:07:16,179 cannot find such a fundamental 186 00:07:16,180 --> 00:07:18,249 right implemented in the way how it 187 00:07:18,250 --> 00:07:20,529 is in the European Union and where there 188 00:07:20,530 --> 00:07:22,779 are no general data protection 189 00:07:22,780 --> 00:07:24,429 rules, but only privacy rules for 190 00:07:24,430 --> 00:07:25,719 sororities. 191 00:07:25,720 --> 00:07:27,429 And then, of course, this leads to the 192 00:07:27,430 --> 00:07:29,559 biggest question the biggest task 193 00:07:29,560 --> 00:07:31,629 for us, and that's leading my 194 00:07:31,630 --> 00:07:33,189 political activity in the European 195 00:07:33,190 --> 00:07:35,649 Parliament, the transformation to digital 196 00:07:35,650 --> 00:07:37,269 and global society. 197 00:07:37,270 --> 00:07:39,399 So the transformation of our rules of 198 00:07:39,400 --> 00:07:41,469 values of what we have 199 00:07:41,470 --> 00:07:43,599 been trusting on for years 200 00:07:43,600 --> 00:07:45,759 and centuries into 201 00:07:45,760 --> 00:07:48,099 what is the digital and global society 202 00:07:48,100 --> 00:07:49,179 of today already? 203 00:07:51,190 --> 00:07:53,049 So the development of data protection and 204 00:07:53,050 --> 00:07:55,209 privacy laws goes back, at 205 00:07:55,210 --> 00:07:57,219 least until the 60s, of course, the 206 00:07:57,220 --> 00:07:59,469 concept of privacy is an old one 207 00:07:59,470 --> 00:08:01,509 and a centuries old, but this is the 208 00:08:01,510 --> 00:08:03,639 history of the development 209 00:08:03,640 --> 00:08:05,679 of data protection and privacy laws 210 00:08:06,760 --> 00:08:09,399 starting from the debates on 211 00:08:09,400 --> 00:08:12,129 registers in the United States, which, 212 00:08:12,130 --> 00:08:15,309 by the way, came by some soldiers 213 00:08:15,310 --> 00:08:18,009 situated in HaShoah to Germany 214 00:08:18,010 --> 00:08:20,229 and led to the first data protection 215 00:08:20,230 --> 00:08:21,459 law worldwide. 216 00:08:21,460 --> 00:08:23,589 The Hessian and Schultz 217 00:08:23,590 --> 00:08:27,159 Act in 1970, and 218 00:08:27,160 --> 00:08:29,289 then four years later, the US Privacy 219 00:08:29,290 --> 00:08:31,479 Act was adopted, applicable, as 220 00:08:31,480 --> 00:08:33,819 I said, only to public authorities. 221 00:08:33,820 --> 00:08:35,408 And they already see that there is a 222 00:08:35,409 --> 00:08:37,239 different development in Europe and in 223 00:08:37,240 --> 00:08:39,548 the United States, which is 224 00:08:39,549 --> 00:08:41,979 the privacy protection, protection of 225 00:08:43,030 --> 00:08:45,099 protection from invading 226 00:08:45,100 --> 00:08:47,319 your privacy on the American 227 00:08:47,320 --> 00:08:49,489 side and data protection 228 00:08:49,490 --> 00:08:52,209 so these so-called self-determination 229 00:08:52,210 --> 00:08:55,239 or informational self-determination 230 00:08:55,240 --> 00:08:57,909 in Germany and then afterwards 231 00:08:57,910 --> 00:09:00,129 in most of European countries 232 00:09:00,130 --> 00:09:02,769 during the 70s and 80s on that 233 00:09:02,770 --> 00:09:05,319 you have also the OCD guidelines 234 00:09:05,320 --> 00:09:07,689 based on those concepts 235 00:09:07,690 --> 00:09:09,549 and the Council of Europe's Convention 236 00:09:09,550 --> 00:09:11,979 100, which then was implemented 237 00:09:11,980 --> 00:09:14,229 in all the EU 238 00:09:14,230 --> 00:09:15,489 member states of today. 239 00:09:15,490 --> 00:09:17,589 So that was the starting for 240 00:09:17,590 --> 00:09:19,689 European standards and then 241 00:09:19,690 --> 00:09:21,939 the well-known census judgment 242 00:09:21,940 --> 00:09:24,129 of the German Constitutional Court and 243 00:09:24,130 --> 00:09:26,769 on the 15th of December nineteen 244 00:09:26,770 --> 00:09:28,929 eighty three. So almost 245 00:09:28,930 --> 00:09:31,569 exactly 30 years ago, 246 00:09:31,570 --> 00:09:33,729 where it was mentioned very clearly 247 00:09:33,730 --> 00:09:35,889 already in nineteen eighty three, 248 00:09:35,890 --> 00:09:37,989 that data protection is about 249 00:09:37,990 --> 00:09:40,089 protecting every data processing 250 00:09:40,090 --> 00:09:42,279 activity because every data processing 251 00:09:42,280 --> 00:09:44,349 activity, no matter where and from 252 00:09:44,350 --> 00:09:47,229 whom it's taking place, 253 00:09:47,230 --> 00:09:49,419 it can have an impact on our 254 00:09:49,420 --> 00:09:51,309 fundamental right on self-determination, 255 00:09:51,310 --> 00:09:53,949 personality rights, our dignity 256 00:09:53,950 --> 00:09:56,949 it's deriving from human dignity. 257 00:09:56,950 --> 00:09:59,169 And then the EU 258 00:09:59,170 --> 00:10:01,329 came up and the European Union started 259 00:10:01,330 --> 00:10:03,519 to legislate on these fields, especially 260 00:10:03,520 --> 00:10:05,589 in view of the ongoing 261 00:10:05,590 --> 00:10:07,269 digitalization. As I said, the 262 00:10:07,270 --> 00:10:09,279 Fundamental Data Protection Directive 263 00:10:09,280 --> 00:10:11,559 1995 and then 264 00:10:11,560 --> 00:10:13,719 first rules for the online environment, 265 00:10:13,720 --> 00:10:15,819 the EU Privacy Directive e-Privacy 266 00:10:15,820 --> 00:10:18,129 Directive with the famous 267 00:10:18,130 --> 00:10:19,779 cookie provision. 268 00:10:19,780 --> 00:10:22,089 And just to mention, 269 00:10:22,090 --> 00:10:24,189 it's because it belongs 270 00:10:24,190 --> 00:10:26,199 there. In 2006, the Data Retention 271 00:10:26,200 --> 00:10:28,329 Directive, which at 272 00:10:28,330 --> 00:10:29,979 the moment is in front of the European 273 00:10:29,980 --> 00:10:32,469 Court of Justice, then something 274 00:10:32,470 --> 00:10:34,569 which is completely underestimated 275 00:10:34,570 --> 00:10:36,579 by most of citizens in Europe, but also 276 00:10:36,580 --> 00:10:38,859 worldwide, that there 277 00:10:38,860 --> 00:10:40,689 has been something like an EU 278 00:10:40,690 --> 00:10:43,059 constitution passed in 279 00:10:43,060 --> 00:10:44,949 1st of December 2009. 280 00:10:44,950 --> 00:10:46,029 It came into force. 281 00:10:46,030 --> 00:10:48,189 The Treaty of Lisbon and the Treaty 282 00:10:48,190 --> 00:10:50,559 of Lisbon had specific 283 00:10:50,560 --> 00:10:52,779 provision on data protection and Article 284 00:10:52,780 --> 00:10:53,859 16. 285 00:10:53,860 --> 00:10:56,349 So since the 1st of December 2009, 286 00:10:56,350 --> 00:10:58,809 there a specific mentioning 287 00:10:58,810 --> 00:11:01,209 in the Treaty of the European Union 288 00:11:01,210 --> 00:11:02,829 that everyone has a right to the 289 00:11:02,830 --> 00:11:04,599 protection of personal data concerning 290 00:11:04,600 --> 00:11:05,600 them. 291 00:11:06,040 --> 00:11:08,259 And that's the clear sentence. 292 00:11:08,260 --> 00:11:10,269 And second, the European Parliament and 293 00:11:10,270 --> 00:11:11,949 the council acting in accordance with the 294 00:11:11,950 --> 00:11:13,809 ordinary legislative procedure shall lay 295 00:11:13,810 --> 00:11:16,209 down the rules relating to the protection 296 00:11:16,210 --> 00:11:17,979 of individuals and compliance with these 297 00:11:17,980 --> 00:11:20,019 rules shall be subject to the competent 298 00:11:20,020 --> 00:11:21,789 control of independent authorities. 299 00:11:23,140 --> 00:11:25,599 More specific with the fundamental 300 00:11:25,600 --> 00:11:28,119 rights culture, which also was declared 301 00:11:28,120 --> 00:11:30,249 binding for all EU member states with 302 00:11:30,250 --> 00:11:32,799 the Lisbon Treaty, and don't listen to 303 00:11:32,800 --> 00:11:34,509 British lawyers that there could be an 304 00:11:34,510 --> 00:11:36,879 opt out. It doesn't apply. 305 00:11:36,880 --> 00:11:38,589 This fundamental rights culture is 306 00:11:38,590 --> 00:11:40,729 applicable for all EU member states and 307 00:11:40,730 --> 00:11:42,819 articulate says clearly again, 308 00:11:42,820 --> 00:11:44,949 everyone meaning 309 00:11:44,950 --> 00:11:47,109 just to note it's a 310 00:11:47,110 --> 00:11:49,389 human rights, not only a citizen's 311 00:11:49,390 --> 00:11:51,489 right. Everyone has the right to 312 00:11:51,490 --> 00:11:53,679 the protection of personal data, so data 313 00:11:53,680 --> 00:11:56,289 protection not only privacy protection 314 00:11:56,290 --> 00:11:57,879 concerning him or her. 315 00:11:57,880 --> 00:12:00,369 Second, such data must be processed 316 00:12:00,370 --> 00:12:03,399 fairly for specific purposes, 317 00:12:03,400 --> 00:12:05,469 purpose limitation and on the 318 00:12:05,470 --> 00:12:08,169 basis of consent or 319 00:12:08,170 --> 00:12:10,479 of some other legitimate 320 00:12:10,480 --> 00:12:12,849 basis laid down by law, meaning that 321 00:12:12,850 --> 00:12:15,279 data processing in the EU is only lawful, 322 00:12:15,280 --> 00:12:17,469 only allowed if it's based one on 323 00:12:17,470 --> 00:12:20,079 consent or second on a specific 324 00:12:20,080 --> 00:12:21,080 law. 325 00:12:21,580 --> 00:12:23,769 Everyone has a right to access 326 00:12:23,770 --> 00:12:24,770 to data. 327 00:12:25,840 --> 00:12:28,179 Some journalists really feel 328 00:12:28,180 --> 00:12:30,219 quite surprised when I say in Europe, the 329 00:12:30,220 --> 00:12:31,419 right to access your data is a 330 00:12:31,420 --> 00:12:32,889 fundamental right, as written in the 331 00:12:32,890 --> 00:12:34,239 fundamental rights culture. 332 00:12:34,240 --> 00:12:36,369 You can ask whomever 333 00:12:36,370 --> 00:12:38,439 which personal data he or she 334 00:12:38,440 --> 00:12:41,049 has collected about you 335 00:12:41,050 --> 00:12:42,909 and the right to have a directive fight, 336 00:12:42,910 --> 00:12:44,259 including, of course, the right to 337 00:12:44,260 --> 00:12:45,279 deletion. 338 00:12:45,280 --> 00:12:47,679 And the independent authorities, 339 00:12:47,680 --> 00:12:50,079 of course, is a very important 340 00:12:50,080 --> 00:12:52,179 issue of EU law, and that's 341 00:12:52,180 --> 00:12:54,429 something which has been enforced vis 342 00:12:54,430 --> 00:12:57,009 a vis Germany, for example once. 343 00:12:57,010 --> 00:12:59,439 But at the end, the enforcement 344 00:12:59,440 --> 00:13:00,489 is a problem. 345 00:13:00,490 --> 00:13:02,349 So who's the European Union? 346 00:13:02,350 --> 00:13:04,119 What are they doing? So this is a famous 347 00:13:04,120 --> 00:13:05,739 picture of how people see the European 348 00:13:05,740 --> 00:13:06,740 Union 349 00:13:07,960 --> 00:13:10,989 quite a bureaucratic block and 350 00:13:10,990 --> 00:13:13,119 unknown officials working on our future. 351 00:13:14,140 --> 00:13:15,669 Just half of the truth. 352 00:13:15,670 --> 00:13:17,259 This is the other half. 353 00:13:17,260 --> 00:13:18,459 It's also democracy. 354 00:13:18,460 --> 00:13:20,319 This is a parliament in which I work, and 355 00:13:20,320 --> 00:13:21,939 somewhere I'm sitting there. 356 00:13:21,940 --> 00:13:24,519 You will not find me out, but 357 00:13:24,520 --> 00:13:26,619 there you have seven hundred 358 00:13:26,620 --> 00:13:28,299 sixty six members of the European 359 00:13:28,300 --> 00:13:30,429 Parliament. They are deciding about 360 00:13:30,430 --> 00:13:32,739 the legislation in the European Union, 361 00:13:32,740 --> 00:13:34,809 but that's also half the truth. 362 00:13:34,810 --> 00:13:36,939 The real decisive 363 00:13:36,940 --> 00:13:39,309 people. So the decision 364 00:13:39,310 --> 00:13:41,979 makers are sitting in these two rooms 365 00:13:41,980 --> 00:13:43,539 on the left side. Do you have the Justice 366 00:13:43,540 --> 00:13:44,709 and Home Affairs Committee in the 367 00:13:44,710 --> 00:13:45,999 European Parliament? 368 00:13:46,000 --> 00:13:47,679 Only a few people sitting in. 369 00:13:47,680 --> 00:13:49,119 That's normal. 370 00:13:49,120 --> 00:13:51,159 You have sometimes only five or six 371 00:13:51,160 --> 00:13:53,949 people caring about the Legislative Act 372 00:13:53,950 --> 00:13:55,989 and on the right side, the Justice and 373 00:13:55,990 --> 00:13:57,609 Home Affairs Council of Ministers. 374 00:14:00,210 --> 00:14:02,459 So those are the main bodies 375 00:14:02,460 --> 00:14:04,019 deciding about the rules in the European 376 00:14:04,020 --> 00:14:06,119 Union, that was just some excuse 377 00:14:06,120 --> 00:14:08,399 on how the legislative 378 00:14:08,400 --> 00:14:09,599 process works. 379 00:14:09,600 --> 00:14:11,459 Just to let you know that lead 380 00:14:11,460 --> 00:14:13,559 negotiators, as I mentioned 381 00:14:14,610 --> 00:14:16,799 myself on the Data Protection Regulation 382 00:14:16,800 --> 00:14:18,479 and then there was a directive on law 383 00:14:18,480 --> 00:14:21,149 enforcement, I will explain that 384 00:14:21,150 --> 00:14:23,219 which is led by Dimitri Stuarts as a 385 00:14:23,220 --> 00:14:25,229 Greek member of the European Parliament 386 00:14:25,230 --> 00:14:27,089 and on the side of the council, you have 387 00:14:27,090 --> 00:14:28,829 rotating presidencies. 388 00:14:28,830 --> 00:14:30,929 First off, 2014 will be the Greek 389 00:14:30,930 --> 00:14:33,689 presidency starting from 1st of January 390 00:14:33,690 --> 00:14:35,639 and then the Italian presidency first of 391 00:14:35,640 --> 00:14:37,979 July. So that's the year of 2014, 392 00:14:37,980 --> 00:14:40,019 and there are in these two rooms that 393 00:14:40,020 --> 00:14:42,269 will be the decisions made on our 394 00:14:42,270 --> 00:14:44,399 privacy and data protection in Europe 395 00:14:44,400 --> 00:14:45,400 and worldwide. 396 00:14:47,190 --> 00:14:49,799 So what's happened until now 397 00:14:49,800 --> 00:14:50,739 from 2009? 398 00:14:50,740 --> 00:14:52,799 So starting from the Lisbon Treaty to 399 00:14:52,800 --> 00:14:55,169 2011, there was a consultation process. 400 00:14:55,170 --> 00:14:56,939 The European Commission already has to do 401 00:14:56,940 --> 00:14:59,489 a consultation process before introducing 402 00:14:59,490 --> 00:15:01,739 new laws on the repeal 403 00:15:01,740 --> 00:15:03,599 on the possible repeal of the Data 404 00:15:03,600 --> 00:15:05,699 Protection Directive from 1995 and July 405 00:15:05,700 --> 00:15:07,889 to July 2011. 406 00:15:07,890 --> 00:15:09,749 At the end of this consultation process, 407 00:15:09,750 --> 00:15:11,819 the European Parliament also passed 408 00:15:11,820 --> 00:15:14,429 through a resolution asking 409 00:15:14,430 --> 00:15:17,429 for first one single EU 410 00:15:17,430 --> 00:15:19,439 standards for data protection on the 411 00:15:19,440 --> 00:15:22,259 basis of the Directive 1995, 412 00:15:22,260 --> 00:15:23,999 so not lower. 413 00:15:24,000 --> 00:15:25,979 Second, strengthening of individual 414 00:15:25,980 --> 00:15:26,969 rights. 415 00:15:26,970 --> 00:15:28,439 Of course, it was a bit more 416 00:15:28,440 --> 00:15:29,969 sophisticated, but it would come to the 417 00:15:29,970 --> 00:15:31,379 points later. 418 00:15:31,380 --> 00:15:33,419 And third, sharp sanctions and 419 00:15:33,420 --> 00:15:35,669 consistency in enforcement 420 00:15:35,670 --> 00:15:37,829 in the European Union and by all 421 00:15:37,830 --> 00:15:39,869 the European Union's authorities and the 422 00:15:39,870 --> 00:15:41,069 European Union's member states' 423 00:15:41,070 --> 00:15:42,779 authorities. And of course, all the 424 00:15:42,780 --> 00:15:45,329 companies. So this is about 425 00:15:45,330 --> 00:15:46,710 a market regulation 426 00:15:48,120 --> 00:15:50,370 or market location principle. 427 00:15:53,010 --> 00:15:55,169 These demands and the results 428 00:15:55,170 --> 00:15:57,299 of the consultation process then ended up 429 00:15:57,300 --> 00:15:58,559 in the proposal by the European 430 00:15:58,560 --> 00:16:00,819 Commission in January 2012. 431 00:16:00,820 --> 00:16:02,339 So last year, in January, 432 00:16:03,660 --> 00:16:05,669 two files were presented. 433 00:16:05,670 --> 00:16:07,829 One Regulation on data 434 00:16:07,830 --> 00:16:10,049 protection for almost all 435 00:16:10,050 --> 00:16:12,209 the sectors and a directive 436 00:16:12,210 --> 00:16:14,249 excluding the law enforcement authorities 437 00:16:14,250 --> 00:16:16,349 from a directive means it has 438 00:16:16,350 --> 00:16:17,969 to be implemented in EU law. 439 00:16:17,970 --> 00:16:19,949 So still, after it passed through a 440 00:16:19,950 --> 00:16:21,989 directive, member states of the European 441 00:16:21,990 --> 00:16:23,669 Union are implementing it and then 442 00:16:23,670 --> 00:16:24,869 national laws. 443 00:16:24,870 --> 00:16:27,749 A regulation doesn't do that. 444 00:16:27,750 --> 00:16:29,849 Data for the Data Protection Regulation 445 00:16:29,850 --> 00:16:31,439 would be directly applicable for the 446 00:16:31,440 --> 00:16:33,569 whole European Union 500 million citizens 447 00:16:33,570 --> 00:16:36,779 and a huge internal market, 448 00:16:36,780 --> 00:16:38,999 no transposing 449 00:16:39,000 --> 00:16:41,249 law for a member state anymore and direct 450 00:16:41,250 --> 00:16:43,439 a particular application by data 451 00:16:43,440 --> 00:16:45,689 protection authorities in Europe and 452 00:16:45,690 --> 00:16:47,009 by the courts, 453 00:16:48,480 --> 00:16:51,149 national courts and 454 00:16:51,150 --> 00:16:52,889 in last instance, European Court of 455 00:16:52,890 --> 00:16:54,449 Justice in Luxembourg. 456 00:16:54,450 --> 00:16:56,789 In March 2012, then 457 00:16:56,790 --> 00:16:58,049 the rapporteurs in the European 458 00:16:58,050 --> 00:16:59,289 Parliament were appointed. 459 00:16:59,290 --> 00:17:01,499 So my work start, we did hundreds of 460 00:17:01,500 --> 00:17:04,259 hearings, meetings, discussions since 461 00:17:04,260 --> 00:17:06,328 and in January 2013 462 00:17:06,329 --> 00:17:08,189 presented draft reports. 463 00:17:08,190 --> 00:17:10,409 So our recommendations as 464 00:17:10,410 --> 00:17:12,299 rapporteurs for the changes to the 465 00:17:12,300 --> 00:17:14,818 commission proposals and collected 466 00:17:14,819 --> 00:17:16,889 the amendments by the other members of 467 00:17:16,890 --> 00:17:18,358 the European Parliament, by the political 468 00:17:18,359 --> 00:17:19,348 groups. 469 00:17:19,349 --> 00:17:21,779 And in October 2013. 470 00:17:21,780 --> 00:17:23,399 So two months ago, we voted on the 471 00:17:23,400 --> 00:17:24,929 European Parliament's position for 472 00:17:24,930 --> 00:17:27,239 negotiations in almost 473 00:17:27,240 --> 00:17:28,559 unanimously. 474 00:17:28,560 --> 00:17:30,689 It was voted almost unanimously, and 475 00:17:30,690 --> 00:17:32,939 it opened the negotiations with 476 00:17:32,940 --> 00:17:35,309 the council in a window 477 00:17:35,310 --> 00:17:38,609 of opportunity until March April 2014. 478 00:17:38,610 --> 00:17:41,159 If we will not conclude negotiations 479 00:17:41,160 --> 00:17:42,719 with the council until then, the European 480 00:17:42,720 --> 00:17:44,849 Parliament will go to a plenary vote. 481 00:17:46,900 --> 00:17:49,029 So some details on the process, first of 482 00:17:49,030 --> 00:17:51,819 all, this was 483 00:17:51,820 --> 00:17:54,039 literally the biggest lobbying tsunami 484 00:17:54,040 --> 00:17:55,719 ever in Brussels. 485 00:17:55,720 --> 00:17:58,929 So me and my stuff, we had hundreds 486 00:17:58,930 --> 00:18:01,209 of meetings with lobbyists alone. 487 00:18:01,210 --> 00:18:03,429 In nine months of 2012, we registered 488 00:18:03,430 --> 00:18:05,199 268 meetings. 489 00:18:05,200 --> 00:18:08,319 We published all of them on my website. 490 00:18:08,320 --> 00:18:10,389 And it was, 491 00:18:10,390 --> 00:18:13,149 I would say, 80 90 percent 492 00:18:13,150 --> 00:18:15,309 lobbying by industry and 493 00:18:15,310 --> 00:18:17,769 the rest shared by 494 00:18:17,770 --> 00:18:19,929 very different interest groups 495 00:18:19,930 --> 00:18:23,229 coming from civil society authorities 496 00:18:23,230 --> 00:18:25,899 or unions, 497 00:18:25,900 --> 00:18:28,239 whatever interest groups, non 498 00:18:28,240 --> 00:18:29,499 industry. 499 00:18:29,500 --> 00:18:31,809 Some of them were understandable. 500 00:18:31,810 --> 00:18:34,059 Concerns like SMS 501 00:18:34,060 --> 00:18:35,289 should be overburdened. 502 00:18:35,290 --> 00:18:37,569 So we don't want the bakery to 503 00:18:38,770 --> 00:18:40,839 have overburdening 504 00:18:40,840 --> 00:18:42,999 duties by these data protection 505 00:18:43,000 --> 00:18:44,289 rules. 506 00:18:44,290 --> 00:18:46,449 Why we could ask why your bakery 507 00:18:46,450 --> 00:18:48,369 anyhow should process personal data. 508 00:18:49,840 --> 00:18:51,939 But that was very often 509 00:18:51,940 --> 00:18:54,279 the example and of course, 510 00:18:54,280 --> 00:18:56,049 the right to be forgotten. 511 00:18:56,050 --> 00:18:58,119 Huge debate, which is still going 512 00:18:58,120 --> 00:19:00,669 on and where there are very different 513 00:19:00,670 --> 00:19:02,769 ideas and concerns. 514 00:19:04,000 --> 00:19:06,549 But of course, also some 515 00:19:06,550 --> 00:19:07,809 just way over the top. 516 00:19:07,810 --> 00:19:09,219 So there have been quite a lot of 517 00:19:09,220 --> 00:19:10,179 concerns. 518 00:19:10,180 --> 00:19:12,399 Trying to completely eliminate 519 00:19:12,400 --> 00:19:14,529 data protection as the concept as 520 00:19:14,530 --> 00:19:16,779 we have it today undermine 521 00:19:16,780 --> 00:19:18,669 the fundamental rights which are in our 522 00:19:18,670 --> 00:19:20,889 constitutions, that European data 523 00:19:20,890 --> 00:19:22,989 protection should not apply to this 524 00:19:22,990 --> 00:19:25,149 or that area or not to our 525 00:19:25,150 --> 00:19:27,369 business or whatever 526 00:19:27,370 --> 00:19:29,499 that data processing should 527 00:19:29,500 --> 00:19:31,149 be possible without the consent of 528 00:19:31,150 --> 00:19:33,279 citizens under the 529 00:19:33,280 --> 00:19:35,619 term of legitimate interests 530 00:19:35,620 --> 00:19:38,140 in several regions 531 00:19:39,370 --> 00:19:41,499 and scope of data protection 532 00:19:41,500 --> 00:19:42,729 as such should be reduced. 533 00:19:42,730 --> 00:19:44,859 So those we 534 00:19:44,860 --> 00:19:47,079 we had to face those concerns, of course, 535 00:19:47,080 --> 00:19:49,989 and those who were brought in 536 00:19:49,990 --> 00:19:52,119 quite a lot of them by 537 00:19:52,120 --> 00:19:54,819 lobbying groups trying to 538 00:19:54,820 --> 00:19:57,339 approach European parliamentarians 539 00:19:57,340 --> 00:19:59,499 with hundreds of amendments to be sent 540 00:19:59,500 --> 00:20:01,749 in. And at the end, there were 541 00:20:01,750 --> 00:20:03,879 hundreds or even thousands of amendments 542 00:20:03,880 --> 00:20:06,429 sent in completely 543 00:20:06,430 --> 00:20:08,829 copy pasting proposals 544 00:20:08,830 --> 00:20:10,869 by industry groups or other interest 545 00:20:10,870 --> 00:20:12,159 groups. 546 00:20:12,160 --> 00:20:15,489 Most of them, of course, companies like 547 00:20:15,490 --> 00:20:18,039 Amazon, eBay, Facebook, Google, 548 00:20:18,040 --> 00:20:20,349 coming from Silicon Valley 549 00:20:20,350 --> 00:20:22,059 or the American Chamber of Commerce. 550 00:20:22,060 --> 00:20:24,399 Their representation in the world. 551 00:20:24,400 --> 00:20:26,619 Somehow, you can find it on these 552 00:20:26,620 --> 00:20:27,939 websites. 553 00:20:27,940 --> 00:20:30,069 Those data journalists did an overview 554 00:20:30,070 --> 00:20:32,019 and they still do it. 555 00:20:32,020 --> 00:20:33,459 It's very helpful for European 556 00:20:33,460 --> 00:20:35,709 legislation, as it's quite 557 00:20:35,710 --> 00:20:38,049 complicated to understand how 558 00:20:38,050 --> 00:20:39,310 decisions are made. 559 00:20:40,570 --> 00:20:42,249 At the end, we had three thousand nine 560 00:20:42,250 --> 00:20:44,199 hundred ninety nine amendments to deal 561 00:20:44,200 --> 00:20:45,159 with. 562 00:20:45,160 --> 00:20:46,160 So that was 563 00:20:47,230 --> 00:20:50,229 what we had on our tables in 564 00:20:50,230 --> 00:20:52,299 around March this 565 00:20:52,300 --> 00:20:53,300 year. 566 00:20:55,080 --> 00:20:57,839 I don't know the number of the pages, so 567 00:20:57,840 --> 00:21:00,059 but you can imagine it's quite a lot 568 00:21:00,060 --> 00:21:02,729 and it was hundreds 569 00:21:02,730 --> 00:21:04,919 of pages and that as 570 00:21:04,920 --> 00:21:07,049 a green is quite hurtful 571 00:21:08,940 --> 00:21:11,039 to see because these three 572 00:21:11,040 --> 00:21:12,329 thousand nine hundred ninety nine 573 00:21:12,330 --> 00:21:14,069 amendments in the European Union need to 574 00:21:14,070 --> 00:21:16,259 be translated into 23 official 575 00:21:16,260 --> 00:21:17,260 languages. 576 00:21:20,340 --> 00:21:22,559 So the first 577 00:21:22,560 --> 00:21:25,049 meeting scrutinizing these amendments 578 00:21:25,050 --> 00:21:26,789 in our committee. 579 00:21:26,790 --> 00:21:29,189 You remember the room I showed you were 580 00:21:29,190 --> 00:21:31,799 that every place had such a 581 00:21:31,800 --> 00:21:34,139 staple of amendments 582 00:21:34,140 --> 00:21:36,479 on its table and 583 00:21:36,480 --> 00:21:38,759 the parliamentarians had to, first 584 00:21:38,760 --> 00:21:39,969 of all, read all of them. 585 00:21:39,970 --> 00:21:42,269 Of course, not all of them did. 586 00:21:42,270 --> 00:21:44,459 But we had to to find 587 00:21:44,460 --> 00:21:47,909 the compromises and to find 588 00:21:47,910 --> 00:21:49,949 solutions for the core issues. 589 00:21:49,950 --> 00:21:52,169 So what have been the 590 00:21:52,170 --> 00:21:55,079 core issues in all these debates? 591 00:21:55,080 --> 00:21:57,269 First of all, the definitions, what is 592 00:21:57,270 --> 00:21:58,499 personal data? 593 00:21:58,500 --> 00:22:00,419 That's the central question of data 594 00:22:00,420 --> 00:22:01,529 protection. 595 00:22:01,530 --> 00:22:03,210 So questions like 596 00:22:04,410 --> 00:22:06,569 how to deal with IP addresses, how to 597 00:22:06,570 --> 00:22:08,789 deal with RFID 598 00:22:08,790 --> 00:22:10,979 IDs or 599 00:22:10,980 --> 00:22:12,749 cookie IDs, etc. 600 00:22:12,750 --> 00:22:15,359 So we managed to 601 00:22:15,360 --> 00:22:17,669 cover most of those in 602 00:22:17,670 --> 00:22:19,619 the definition. We still managed to hold 603 00:22:19,620 --> 00:22:22,829 the definition quite broad. 604 00:22:22,830 --> 00:22:24,689 Second point, of course, also the 605 00:22:24,690 --> 00:22:26,339 question what means 606 00:22:27,600 --> 00:22:29,849 personal data, which leads 607 00:22:29,850 --> 00:22:31,410 to identification or which 608 00:22:32,640 --> 00:22:35,699 leads to an identifiable 609 00:22:35,700 --> 00:22:37,589 information? 610 00:22:37,590 --> 00:22:39,299 Should there be an addition? 611 00:22:39,300 --> 00:22:41,459 That identifiable also means 612 00:22:41,460 --> 00:22:44,129 singling out someone 613 00:22:44,130 --> 00:22:46,589 we managed to to hold the discussions 614 00:22:46,590 --> 00:22:49,329 on that and at the end had some, 615 00:22:49,330 --> 00:22:50,330 uh, 616 00:22:51,390 --> 00:22:53,729 some signal that 617 00:22:53,730 --> 00:22:55,029 this is also covered. 618 00:22:55,030 --> 00:22:56,910 And hopefully this will also 619 00:22:57,930 --> 00:23:00,029 be prevailing 620 00:23:00,030 --> 00:23:01,709 in the negotiations with the Council of 621 00:23:01,710 --> 00:23:02,710 Ministers. 622 00:23:03,750 --> 00:23:04,750 Thank you. 623 00:23:10,160 --> 00:23:11,209 The second big 624 00:23:12,620 --> 00:23:15,979 point is consent, so the question 625 00:23:15,980 --> 00:23:18,469 how needs consent to be given 626 00:23:18,470 --> 00:23:20,539 if you use the 627 00:23:20,540 --> 00:23:22,969 justification for a data processing 628 00:23:22,970 --> 00:23:24,589 that there is consent, it has to be 629 00:23:24,590 --> 00:23:26,509 specific, it has to be informed and 630 00:23:26,510 --> 00:23:27,529 explicit. 631 00:23:27,530 --> 00:23:29,659 That was a huge fight 632 00:23:29,660 --> 00:23:30,559 in the European Parliament. 633 00:23:30,560 --> 00:23:33,109 At the end, we got the explicit 634 00:23:33,110 --> 00:23:35,179 consent in the position of the European 635 00:23:35,180 --> 00:23:37,459 Parliament, and that's quite a success 636 00:23:37,460 --> 00:23:38,510 in my view, because 637 00:23:39,950 --> 00:23:42,349 the way to undermine consent 638 00:23:42,350 --> 00:23:44,809 during the last five, 10 or even 15 639 00:23:44,810 --> 00:23:47,059 years was already made 640 00:23:47,060 --> 00:23:48,559 and it's already going on. 641 00:23:48,560 --> 00:23:50,749 So we need to work on that. 642 00:23:50,750 --> 00:23:52,309 And that was one of the core issues we 643 00:23:52,310 --> 00:23:53,449 need to tackle. 644 00:23:53,450 --> 00:23:55,549 And the scope of application, of course, 645 00:23:55,550 --> 00:23:58,169 was one of our greatest concerns. 646 00:23:58,170 --> 00:23:59,809 First of all, that we have a market 647 00:23:59,810 --> 00:24:01,069 allocation principle. 648 00:24:02,090 --> 00:24:03,649 I already referred to it. 649 00:24:03,650 --> 00:24:05,839 So this means that 650 00:24:05,840 --> 00:24:08,059 the European Union sets its EU 651 00:24:08,060 --> 00:24:10,159 data protection standards in a way that 652 00:24:10,160 --> 00:24:12,919 it's applicable to whomever 653 00:24:12,920 --> 00:24:15,079 is acting on the European Union's 654 00:24:15,080 --> 00:24:17,359 territory or whomever 655 00:24:17,360 --> 00:24:19,129 is acting on the European Union's 656 00:24:19,130 --> 00:24:20,659 markets. 657 00:24:20,660 --> 00:24:21,660 Both of its. 658 00:24:22,570 --> 00:24:24,939 Which means that 659 00:24:24,940 --> 00:24:28,089 if there's a company based somewhere 660 00:24:28,090 --> 00:24:30,819 in China acting on the European markets 661 00:24:30,820 --> 00:24:32,649 through online business, for example, 662 00:24:32,650 --> 00:24:34,929 it's applicable, which means 663 00:24:34,930 --> 00:24:37,869 it's a territorial extraterritorial 664 00:24:37,870 --> 00:24:39,339 application of our rules. 665 00:24:39,340 --> 00:24:41,799 I think that this is the main change 666 00:24:41,800 --> 00:24:44,019 of these laws because it's saying clearly 667 00:24:44,020 --> 00:24:46,179 for the European Union, we have to 668 00:24:46,180 --> 00:24:48,699 safeguard the right to data protection 669 00:24:48,700 --> 00:24:50,410 wherever we can 670 00:24:51,520 --> 00:24:53,319 and that we do by market regulation. 671 00:25:01,140 --> 00:25:03,149 Second question, not so big, but 672 00:25:03,150 --> 00:25:05,999 interesting, the EU institutions 673 00:25:06,000 --> 00:25:08,369 have been regulated already by 674 00:25:08,370 --> 00:25:11,099 a regulation, so there was a question 675 00:25:11,100 --> 00:25:13,259 how to include those in 676 00:25:13,260 --> 00:25:16,169 the protection of these new regulation. 677 00:25:16,170 --> 00:25:18,119 Quite a technical task, but at the end we 678 00:25:18,120 --> 00:25:20,189 managed to do so in 679 00:25:20,190 --> 00:25:22,829 a transition provision 680 00:25:22,830 --> 00:25:25,109 and even more important 681 00:25:25,110 --> 00:25:27,119 again, the private and household 682 00:25:27,120 --> 00:25:29,759 exemption. So the question 683 00:25:29,760 --> 00:25:31,889 what does it mean to be 684 00:25:31,890 --> 00:25:34,079 exempted by these data protection rules? 685 00:25:34,080 --> 00:25:36,359 Because I'm doing data processing. 686 00:25:36,360 --> 00:25:38,579 In the course of my private own private 687 00:25:38,580 --> 00:25:39,810 and household activities, 688 00:25:41,250 --> 00:25:43,709 the question which role 689 00:25:43,710 --> 00:25:45,269 gainful interest plays, 690 00:25:46,410 --> 00:25:48,479 where it's clear that if there 691 00:25:48,480 --> 00:25:50,489 is gainful interest, 692 00:25:52,230 --> 00:25:53,729 if there is private or household 693 00:25:53,730 --> 00:25:55,769 activity, still it should be covered by 694 00:25:55,770 --> 00:25:56,699 this exemption. 695 00:25:56,700 --> 00:25:58,229 On the other side, it should be clear 696 00:25:58,230 --> 00:26:00,599 that if you 697 00:26:00,600 --> 00:26:02,489 act in a way that it's 698 00:26:03,540 --> 00:26:05,759 not usually seen as 699 00:26:05,760 --> 00:26:07,889 to be a private activity 700 00:26:07,890 --> 00:26:09,839 or household activity, you should be in 701 00:26:09,840 --> 00:26:11,190 the duties again, of course. 702 00:26:13,010 --> 00:26:14,029 Next issue. 703 00:26:14,030 --> 00:26:15,919 Legitimate interest, I already referred 704 00:26:15,920 --> 00:26:17,959 to a legitimate interest as one of the 705 00:26:17,960 --> 00:26:20,539 most important loopholes 706 00:26:20,540 --> 00:26:23,749 in the existing protection 707 00:26:23,750 --> 00:26:26,329 because in the director from 1995, 708 00:26:26,330 --> 00:26:28,129 it was clear that legitimate interest can 709 00:26:28,130 --> 00:26:30,679 be a legal ground for processing, 710 00:26:30,680 --> 00:26:32,119 but it was not further defined. 711 00:26:32,120 --> 00:26:33,679 So there were very different 712 00:26:33,680 --> 00:26:35,929 interpretations in EU member states. 713 00:26:35,930 --> 00:26:38,059 Why in Austria you have to opt 714 00:26:38,060 --> 00:26:40,549 into almost everything and legitimate 715 00:26:40,550 --> 00:26:43,039 interest is absolutely the exception 716 00:26:43,040 --> 00:26:45,529 in the UK, it's the other way round. 717 00:26:45,530 --> 00:26:47,719 So this is the way 718 00:26:47,720 --> 00:26:49,579 where we came from and where we needed to 719 00:26:49,580 --> 00:26:51,589 debate about the question how to reduce 720 00:26:51,590 --> 00:26:54,289 the scope and the possibilities 721 00:26:54,290 --> 00:26:56,029 for data processing and the legitimate 722 00:26:56,030 --> 00:26:57,259 interest. 723 00:26:57,260 --> 00:26:59,329 And we brought in the 724 00:26:59,330 --> 00:27:01,619 idea of saying that legitimate interest 725 00:27:01,620 --> 00:27:03,949 every always has to meet 726 00:27:03,950 --> 00:27:06,019 the reasonable expectations based on 727 00:27:06,020 --> 00:27:07,369 the relationship with the data 728 00:27:07,370 --> 00:27:08,779 controller. 729 00:27:08,780 --> 00:27:10,879 So my reasonable expectations 730 00:27:10,880 --> 00:27:12,919 should play a central role. 731 00:27:12,920 --> 00:27:14,989 It shouldn't be a company 732 00:27:14,990 --> 00:27:17,179 which I never have seen and never have 733 00:27:17,180 --> 00:27:19,399 contact had contact to 734 00:27:19,400 --> 00:27:21,679 collecting my personal data just because 735 00:27:21,680 --> 00:27:23,720 it thinks it's legitimate interest. 736 00:27:27,350 --> 00:27:29,929 The second big point 737 00:27:29,930 --> 00:27:32,269 in this scope was the direct 738 00:27:32,270 --> 00:27:33,769 marketing issue. 739 00:27:33,770 --> 00:27:36,529 Direct marketing issue is one of the most 740 00:27:36,530 --> 00:27:38,729 important debates because there 741 00:27:38,730 --> 00:27:40,970 is most money in 742 00:27:42,200 --> 00:27:44,630 and most growth opportunities today are 743 00:27:45,770 --> 00:27:47,839 based on direct marketing with personal 744 00:27:47,840 --> 00:27:48,840 data. 745 00:27:50,450 --> 00:27:52,579 They are different starting points in 746 00:27:52,580 --> 00:27:53,719 the EU member states. 747 00:27:53,720 --> 00:27:55,609 And what's the position in the European 748 00:27:55,610 --> 00:27:57,949 Parliament now brought at the end 749 00:27:57,950 --> 00:27:59,179 as a differentiation? 750 00:27:59,180 --> 00:28:01,309 Was that in the internet only for all and 751 00:28:01,310 --> 00:28:03,049 similar goods and services, direct 752 00:28:03,050 --> 00:28:06,499 marketing can be a legitimate interests 753 00:28:06,500 --> 00:28:08,869 and only in the analog 754 00:28:08,870 --> 00:28:11,119 environment. If you do, direct marketing 755 00:28:11,120 --> 00:28:13,339 by snow may in most EU member states, 756 00:28:13,340 --> 00:28:15,439 it's already today that you can 757 00:28:15,440 --> 00:28:18,229 do it as legitimate interests. 758 00:28:18,230 --> 00:28:20,359 Send letters to 759 00:28:20,360 --> 00:28:22,459 whomever. This is a huge lobbying 760 00:28:22,460 --> 00:28:24,859 fight, of course, and I would have 761 00:28:24,860 --> 00:28:26,569 liked to reduce it even more. 762 00:28:26,570 --> 00:28:28,819 I would have liked to say, I don't want 763 00:28:28,820 --> 00:28:30,259 your mail. But 764 00:28:31,460 --> 00:28:33,589 unless I say yes, I want 765 00:28:33,590 --> 00:28:36,079 it. But at the end we got this. 766 00:28:36,080 --> 00:28:38,299 And still important is 767 00:28:38,300 --> 00:28:40,609 that an opt out is always possible. 768 00:28:40,610 --> 00:28:42,829 So an analog and 769 00:28:42,830 --> 00:28:45,319 digital environment, of course, 770 00:28:45,320 --> 00:28:47,479 you get your opt out wherever it is, and 771 00:28:47,480 --> 00:28:49,159 it always needs to be. 772 00:28:49,160 --> 00:28:50,959 They are highly visible with highly 773 00:28:50,960 --> 00:28:53,359 visible information, and there's also 774 00:28:53,360 --> 00:28:55,759 an incentive to have do not track 775 00:28:55,760 --> 00:28:58,009 possibilities and technologies developed 776 00:28:58,010 --> 00:28:59,900 and certified. 777 00:29:01,820 --> 00:29:04,039 Next, find profiling a very important 778 00:29:04,040 --> 00:29:06,799 debate because in the current 779 00:29:06,800 --> 00:29:08,659 legal frameworks, profiling doesn't play 780 00:29:08,660 --> 00:29:10,399 such a very important role. 781 00:29:10,400 --> 00:29:13,279 It's automated processing, 782 00:29:13,280 --> 00:29:15,859 which concerns me, always or confuses 783 00:29:15,860 --> 00:29:18,019 me always, because automated processing 784 00:29:18,020 --> 00:29:19,819 seems to be everything today. 785 00:29:19,820 --> 00:29:22,129 So profiling is in the heart 786 00:29:22,130 --> 00:29:24,559 of what we need to regulate it 787 00:29:24,560 --> 00:29:27,049 regulate. And we brought in a specific 788 00:29:27,050 --> 00:29:29,449 article on the limitation 789 00:29:29,450 --> 00:29:31,579 of the use of personal data for 790 00:29:31,580 --> 00:29:33,889 the purpose of profiling and 791 00:29:33,890 --> 00:29:35,899 for profiling as such. 792 00:29:35,900 --> 00:29:36,900 Also, 793 00:29:38,420 --> 00:29:40,309 in addition, privacy by design and 794 00:29:40,310 --> 00:29:42,419 efforts has been brought in as 795 00:29:42,420 --> 00:29:45,259 a new concepts and those 796 00:29:45,260 --> 00:29:47,659 safeguarding a very important 797 00:29:47,660 --> 00:29:49,489 fundamental principle of data protection, 798 00:29:49,490 --> 00:29:51,559 which is data minimization. 799 00:29:51,560 --> 00:29:53,420 And that's, of course, still in 800 00:29:55,010 --> 00:29:58,069 last important core issue. 801 00:29:58,070 --> 00:30:00,319 On substance, the data protection 802 00:30:00,320 --> 00:30:02,989 officer, which is a concept 803 00:30:02,990 --> 00:30:05,419 of deriving from the 804 00:30:05,420 --> 00:30:07,399 example of the German law, where you have 805 00:30:07,400 --> 00:30:10,519 a data protection officer mandatory for 806 00:30:10,520 --> 00:30:12,709 companies having more than nine 807 00:30:12,710 --> 00:30:14,869 persons dealing 808 00:30:14,870 --> 00:30:16,729 with data processing. 809 00:30:16,730 --> 00:30:18,829 And we got away 810 00:30:18,830 --> 00:30:20,569 from the commission's proposal to change 811 00:30:20,570 --> 00:30:22,879 that to 250 employees 812 00:30:22,880 --> 00:30:24,229 because it doesn't make sense. 813 00:30:24,230 --> 00:30:26,779 And now the proposal is that 814 00:30:26,780 --> 00:30:28,969 if there is data processing on 815 00:30:28,970 --> 00:30:31,339 5000 data subjects per year 816 00:30:31,340 --> 00:30:33,139 or more, then there should be an 817 00:30:33,140 --> 00:30:35,389 appointment of a data protection officer. 818 00:30:35,390 --> 00:30:36,739 And of course, this has to be 819 00:30:36,740 --> 00:30:38,959 proportionate to the task so 820 00:30:38,960 --> 00:30:41,150 it can be part time, it can be external. 821 00:30:42,260 --> 00:30:44,719 But it's clear that it helps compliance 822 00:30:44,720 --> 00:30:47,749 with compliance and that it also 823 00:30:47,750 --> 00:30:49,879 helps the data protection authorities 824 00:30:49,880 --> 00:30:52,309 and gives less burden to concentrate 825 00:30:52,310 --> 00:30:53,310 with them. 826 00:30:56,440 --> 00:30:58,569 The entire international transfers, 827 00:30:58,570 --> 00:31:00,729 I come to that also a bit later, 828 00:31:00,730 --> 00:31:02,589 because it was, of course, impacted by 829 00:31:02,590 --> 00:31:05,079 the Snowden revelations, I 830 00:31:05,080 --> 00:31:07,239 now have to be clearly based on EU 831 00:31:07,240 --> 00:31:08,919 law, so there should be a clear 832 00:31:08,920 --> 00:31:10,779 restriction to only what's in the 833 00:31:10,780 --> 00:31:13,599 regulation is possibly to be transferred. 834 00:31:13,600 --> 00:31:15,279 And of course, there are 835 00:31:16,690 --> 00:31:18,759 justifications and and minimum 836 00:31:18,760 --> 00:31:21,129 requirements which have to have to be met 837 00:31:21,130 --> 00:31:22,839 to transfer to third states, 838 00:31:23,980 --> 00:31:25,269 then the consistency. 839 00:31:25,270 --> 00:31:27,459 So the consistent application of these 840 00:31:27,460 --> 00:31:29,739 data protection rules in the European 841 00:31:29,740 --> 00:31:32,319 market or on the European market 842 00:31:32,320 --> 00:31:34,719 and in all the EU member states by 843 00:31:34,720 --> 00:31:37,359 the so-called first One-Stop Shop, 844 00:31:37,360 --> 00:31:39,579 which means what is already 845 00:31:39,580 --> 00:31:41,709 today the case that a company which has 846 00:31:41,710 --> 00:31:43,449 a maintenance establishment on the 847 00:31:43,450 --> 00:31:45,879 European market has 848 00:31:45,880 --> 00:31:48,999 a competent authority for enforcement 849 00:31:49,000 --> 00:31:51,699 and oversight on this company. 850 00:31:51,700 --> 00:31:54,159 For example, Amazon, 851 00:31:54,160 --> 00:31:56,139 based in Luxembourg, Luxembourg is Data 852 00:31:56,140 --> 00:31:58,059 Protection Authority, is competent for 853 00:31:58,060 --> 00:32:00,669 Amazon for the enforcement. 854 00:32:00,670 --> 00:32:02,049 So that's a one stop shop for the 855 00:32:02,050 --> 00:32:04,179 company. But we also brought in the idea 856 00:32:04,180 --> 00:32:06,759 of having a one stop shop for us so 857 00:32:06,760 --> 00:32:08,919 that we can go to our own data protection 858 00:32:08,920 --> 00:32:11,079 authority wherever we are in the European 859 00:32:11,080 --> 00:32:13,389 Union. And these data protection 860 00:32:13,390 --> 00:32:15,549 authorities then have to cooperate, 861 00:32:15,550 --> 00:32:17,679 have to find a common position on 862 00:32:17,680 --> 00:32:19,539 the interpretation of these single data 863 00:32:19,540 --> 00:32:20,979 protection standard on the European 864 00:32:20,980 --> 00:32:23,709 market. And that helps for consistency. 865 00:32:23,710 --> 00:32:25,479 And it helps in a specific case, which I 866 00:32:25,480 --> 00:32:27,999 will point out 867 00:32:28,000 --> 00:32:30,099 in a few minutes at the end. 868 00:32:30,100 --> 00:32:32,319 A final decision in case of conflict is 869 00:32:32,320 --> 00:32:33,939 possible in accordance with the 870 00:32:33,940 --> 00:32:35,169 parliament's position. 871 00:32:35,170 --> 00:32:36,909 So if there is a conflict between data 872 00:32:36,910 --> 00:32:39,849 protection authorities, for example, 873 00:32:39,850 --> 00:32:42,190 a specific authority is not at all acting 874 00:32:43,360 --> 00:32:44,889 or a specific authority has an 875 00:32:44,890 --> 00:32:46,869 interpretation which is completely 876 00:32:46,870 --> 00:32:47,919 outrageous. 877 00:32:47,920 --> 00:32:49,719 Then a two thirds majority of data 878 00:32:49,720 --> 00:32:51,549 protection authorities can overrule a 879 00:32:51,550 --> 00:32:53,529 decision by the Competent Data Protection 880 00:32:53,530 --> 00:32:54,939 Authority. 881 00:32:54,940 --> 00:32:57,609 I think that this cooperative model is 882 00:32:57,610 --> 00:33:00,219 the best approach I've seen until now. 883 00:33:00,220 --> 00:33:02,079 It's safeguarding the independence of 884 00:33:02,080 --> 00:33:03,699 data protection authorities. 885 00:33:03,700 --> 00:33:04,989 It's not bearing up a complete 886 00:33:04,990 --> 00:33:07,719 centralized system in which you 887 00:33:07,720 --> 00:33:10,179 have to contact someone who is completely 888 00:33:10,180 --> 00:33:12,009 out of your region. 889 00:33:12,010 --> 00:33:14,199 But it also helps for consistency, 890 00:33:14,200 --> 00:33:16,509 which is the main 891 00:33:16,510 --> 00:33:19,179 issue here because the loophole, 892 00:33:19,180 --> 00:33:20,919 as I said, a forum shopping in the 893 00:33:20,920 --> 00:33:22,419 European Union is one of the biggest 894 00:33:22,420 --> 00:33:23,709 problems we have. 895 00:33:23,710 --> 00:33:25,989 And the most famous 896 00:33:25,990 --> 00:33:28,089 example is the loophole Ireland. 897 00:33:29,440 --> 00:33:30,940 That's the loophole Ireland's. 898 00:33:32,360 --> 00:33:34,639 This building is somewhere in the suburbs 899 00:33:34,640 --> 00:33:37,699 of Dublin, in Ireland, and 900 00:33:37,700 --> 00:33:39,799 the shop on the left side 901 00:33:39,800 --> 00:33:41,929 is a supermarket and the shop on the 902 00:33:41,930 --> 00:33:44,089 right side is the Irish Data Protection 903 00:33:44,090 --> 00:33:46,150 Commissioner and. 904 00:33:54,200 --> 00:33:56,119 The Irish Data Protection Commissioner is 905 00:33:56,120 --> 00:33:58,429 competent, for example, not 906 00:33:58,430 --> 00:34:00,979 only, but for example, for the company, 907 00:34:00,980 --> 00:34:03,079 Facebook Ireland, 908 00:34:03,080 --> 00:34:05,389 the company, Facebook Ireland 909 00:34:05,390 --> 00:34:07,729 is the main establishment 910 00:34:07,730 --> 00:34:09,919 or the main company of 911 00:34:09,920 --> 00:34:10,920 which 912 00:34:13,340 --> 00:34:15,678 all the people, all the users are in 913 00:34:15,679 --> 00:34:18,019 or contracting with when they are not 914 00:34:18,020 --> 00:34:20,419 based in the US or Canada. 915 00:34:20,420 --> 00:34:22,488 So you could 916 00:34:22,489 --> 00:34:24,888 say Facebook worldwide 917 00:34:24,889 --> 00:34:26,448 and then you have Facebook U.S. 918 00:34:26,449 --> 00:34:28,939 Canada, Facebook Worldwide 919 00:34:28,940 --> 00:34:31,309 is overseen by this authority 920 00:34:33,770 --> 00:34:36,229 that leads that led to the situation 921 00:34:36,230 --> 00:34:38,359 that once there was 922 00:34:38,360 --> 00:34:40,698 an Austrian student called 923 00:34:40,699 --> 00:34:43,129 Max Schrems and he sent 924 00:34:43,130 --> 00:34:45,439 in simple requests 925 00:34:45,440 --> 00:34:47,599 for access, 926 00:34:47,600 --> 00:34:49,819 his personal data by Facebook. 927 00:34:49,820 --> 00:34:52,189 So just asking what 928 00:34:52,190 --> 00:34:54,678 our personal data have you 929 00:34:54,679 --> 00:34:57,019 retained on me, Facebook? 930 00:34:57,020 --> 00:34:59,359 And he sent that letter and got 931 00:34:59,360 --> 00:35:00,289 no answer. 932 00:35:00,290 --> 00:35:02,899 And then he sent 933 00:35:02,900 --> 00:35:05,089 a letter to the Irish 934 00:35:05,090 --> 00:35:08,479 Data Protection Commissioner and 935 00:35:08,480 --> 00:35:09,949 got no answer. 936 00:35:09,950 --> 00:35:12,079 And quite a lot of weeks 937 00:35:12,080 --> 00:35:14,449 later and other 938 00:35:14,450 --> 00:35:15,450 contact 939 00:35:17,120 --> 00:35:19,369 approaches, he 940 00:35:19,370 --> 00:35:21,499 got a reply that there would be no 941 00:35:21,500 --> 00:35:23,599 negotiations on his 942 00:35:23,600 --> 00:35:24,709 case. 943 00:35:24,710 --> 00:35:26,809 And after certain 944 00:35:26,810 --> 00:35:28,909 conversations, he got a DVD 945 00:35:28,910 --> 00:35:31,099 by Facebook with one thousand 946 00:35:31,100 --> 00:35:33,799 two hundred twenty two pages 947 00:35:33,800 --> 00:35:36,049 personal data retained by Facebook 948 00:35:36,050 --> 00:35:37,159 on him. 949 00:35:37,160 --> 00:35:39,289 And quite a lot of it 950 00:35:39,290 --> 00:35:41,629 was not known 951 00:35:41,630 --> 00:35:43,759 by him that it exists, that he has 952 00:35:43,760 --> 00:35:45,919 put it into the 953 00:35:45,920 --> 00:35:47,329 system of Facebook. 954 00:35:47,330 --> 00:35:49,819 And quite a lot of it, he 955 00:35:49,820 --> 00:35:52,369 believed, or he was sure that he already 956 00:35:52,370 --> 00:35:53,870 clicked on delete. 957 00:35:55,130 --> 00:35:57,679 So it was all there and there were plenty 958 00:35:57,680 --> 00:36:00,349 of data protection infringements. 959 00:36:00,350 --> 00:36:02,449 He was studying exactly this the group 960 00:36:02,450 --> 00:36:04,279 of students dealing with data protection 961 00:36:04,280 --> 00:36:06,889 laws. They saw twenty two 962 00:36:06,890 --> 00:36:09,199 different infringements cases 963 00:36:09,200 --> 00:36:11,569 of infringements and started a campaign 964 00:36:11,570 --> 00:36:13,429 which is named Europe versus Facebook. 965 00:36:14,580 --> 00:36:16,439 And in this campaign, they started to 966 00:36:16,440 --> 00:36:18,719 complain against Facebook in front of 967 00:36:18,720 --> 00:36:21,149 the Irish Data Protection Commissioner. 968 00:36:21,150 --> 00:36:23,369 And it took weeks and months, 969 00:36:23,370 --> 00:36:25,589 and it still takes weeks 970 00:36:25,590 --> 00:36:28,109 and months to get these problems 971 00:36:28,110 --> 00:36:29,759 sorted out. 972 00:36:29,760 --> 00:36:31,949 They are not now waiting for the final 973 00:36:31,950 --> 00:36:34,439 answer of the oversight authority 974 00:36:34,440 --> 00:36:36,629 after having sent in all these questions 975 00:36:36,630 --> 00:36:38,879 already. I think one or almost two 976 00:36:38,880 --> 00:36:41,279 years ago and 977 00:36:41,280 --> 00:36:43,589 nothing happened since then, or almost 978 00:36:43,590 --> 00:36:44,549 nothing. 979 00:36:44,550 --> 00:36:46,879 And they are waiting now the answer 980 00:36:46,880 --> 00:36:48,959 of these commissioner. And obviously 981 00:36:48,960 --> 00:36:51,060 this answer will not be 982 00:36:52,530 --> 00:36:54,869 in accordance with the EU data protection 983 00:36:54,870 --> 00:36:57,149 law. So that's what he expects and 984 00:36:57,150 --> 00:36:59,069 what he, I think realistically can 985 00:36:59,070 --> 00:36:59,999 expect. 986 00:37:00,000 --> 00:37:02,129 And that means that he then has to go 987 00:37:02,130 --> 00:37:03,029 to courts. 988 00:37:03,030 --> 00:37:04,949 The competent court will be the Dublin 989 00:37:04,950 --> 00:37:07,109 courts. The Dublin court system 990 00:37:07,110 --> 00:37:08,849 is very complicated, so you need a 991 00:37:08,850 --> 00:37:10,500 specific lawyer 992 00:37:11,640 --> 00:37:14,159 which is trained on filing court cases 993 00:37:14,160 --> 00:37:16,019 in front of Irish courts, and they are 994 00:37:16,020 --> 00:37:17,189 quite expensive. 995 00:37:17,190 --> 00:37:19,439 So no, at the moment they are fundraising 996 00:37:19,440 --> 00:37:21,839 around 300000 euros 997 00:37:21,840 --> 00:37:24,479 to start this complaint 998 00:37:24,480 --> 00:37:26,969 and gets easy things 999 00:37:26,970 --> 00:37:29,099 like the right to deletion of your own 1000 00:37:29,100 --> 00:37:31,019 personal data and enforced. 1001 00:37:32,340 --> 00:37:34,319 So this may take years. 1002 00:37:34,320 --> 00:37:36,539 And that's the reason why 1003 00:37:36,540 --> 00:37:38,999 the system of the EU Data Protection 1004 00:37:39,000 --> 00:37:41,009 Directive from 1995 and the 1005 00:37:41,010 --> 00:37:43,469 implementation into national 1006 00:37:43,470 --> 00:37:45,809 laws has failed because 1007 00:37:45,810 --> 00:37:47,519 the EU Commission, which normally is 1008 00:37:47,520 --> 00:37:49,019 competent for the enforcement of these 1009 00:37:49,020 --> 00:37:51,089 directives vis a vis the member states, 1010 00:37:51,090 --> 00:37:53,219 failed to, at the end really 1011 00:37:53,220 --> 00:37:54,220 enforce it. 1012 00:37:55,110 --> 00:37:56,879 So the 1013 00:37:58,410 --> 00:38:00,689 the the whole thing turned 1014 00:38:00,690 --> 00:38:03,239 around in the legislative procedures. 1015 00:38:03,240 --> 00:38:05,819 But then, of course, the Snowden 1016 00:38:05,820 --> 00:38:07,919 effect came with June 1017 00:38:07,920 --> 00:38:10,229 July, where we already 1018 00:38:10,230 --> 00:38:12,419 believed that before summer, we will 1019 00:38:12,420 --> 00:38:14,789 not really get a breakthrough 1020 00:38:14,790 --> 00:38:17,009 with the negotiations, and 1021 00:38:17,010 --> 00:38:19,109 it would take even longer after summer 1022 00:38:19,110 --> 00:38:21,329 to get these data protection reform 1023 00:38:21,330 --> 00:38:23,459 done. But then after summer, we came 1024 00:38:23,460 --> 00:38:24,689 back and there was. 1025 00:38:26,080 --> 00:38:27,939 At least a little effect. 1026 00:38:27,940 --> 00:38:29,949 So what were the effects, first of all, 1027 00:38:29,950 --> 00:38:32,079 the strategic effect that there 1028 00:38:32,080 --> 00:38:34,629 is now a competitive competitive 1029 00:38:34,630 --> 00:38:36,879 advantage for data protection seen 1030 00:38:36,880 --> 00:38:39,339 by average users 1031 00:38:39,340 --> 00:38:41,089 or politicians? 1032 00:38:41,090 --> 00:38:43,179 You can see an article on 1033 00:38:43,180 --> 00:38:44,180 the 1034 00:38:45,880 --> 00:38:48,039 Yes on the 1035 00:38:48,040 --> 00:38:50,379 lacking encryption on Google 1036 00:38:50,380 --> 00:38:52,629 servers and an ad for Google Cloud 1037 00:38:52,630 --> 00:38:55,089 hosting just right besides it. 1038 00:38:55,090 --> 00:38:57,049 So it has an effect. 1039 00:38:57,050 --> 00:38:59,289 People are realizing it, 1040 00:38:59,290 --> 00:39:00,999 and at least privacy is high on the 1041 00:39:01,000 --> 00:39:03,159 political agenda again. 1042 00:39:03,160 --> 00:39:05,259 But at the end, we all see and that was 1043 00:39:05,260 --> 00:39:07,809 also the conclusion of Glenn Greenwald 1044 00:39:07,810 --> 00:39:08,739 yesterday. 1045 00:39:08,740 --> 00:39:10,869 Lots of promises, but little meat. 1046 00:39:10,870 --> 00:39:12,939 So there's not really much happening. 1047 00:39:12,940 --> 00:39:14,889 What we got through here in the European 1048 00:39:14,890 --> 00:39:17,079 Parliament was, first of all, the 1049 00:39:17,080 --> 00:39:19,389 famous Article 42, 1050 00:39:19,390 --> 00:39:21,819 which was in an article in a 1051 00:39:21,820 --> 00:39:24,159 previous preliminary 1052 00:39:24,160 --> 00:39:26,439 draft of the European Commission, saying 1053 00:39:26,440 --> 00:39:28,899 clearly that, as I said, international 1054 00:39:28,900 --> 00:39:31,389 data transfers need to be based on 1055 00:39:31,390 --> 00:39:33,579 European law, 1056 00:39:33,580 --> 00:39:36,189 meaning clear that 1057 00:39:36,190 --> 00:39:38,409 a Patriot Act order or 1058 00:39:38,410 --> 00:39:40,689 a FISA Act order would not 1059 00:39:40,690 --> 00:39:42,909 be a valid legal ground for an 1060 00:39:42,910 --> 00:39:44,769 international transfer from the European 1061 00:39:44,770 --> 00:39:46,480 Union to a third state. 1062 00:39:55,360 --> 00:39:57,639 I have to say thank you to 1063 00:39:57,640 --> 00:39:59,709 Edward Snowden, because we brought 1064 00:39:59,710 --> 00:40:02,139 this article back into the position 1065 00:40:02,140 --> 00:40:04,839 of the European Parliament after 1066 00:40:04,840 --> 00:40:06,909 his revelations, and it's still 1067 00:40:06,910 --> 00:40:09,099 in there and the European Parliament has 1068 00:40:09,100 --> 00:40:11,259 voted almost unanimously on 1069 00:40:11,260 --> 00:40:13,419 it. That means that 1070 00:40:13,420 --> 00:40:15,549 companies acting on the European markets 1071 00:40:15,550 --> 00:40:18,009 will have troubles if they send personal 1072 00:40:18,010 --> 00:40:20,439 data out of the European Union 1073 00:40:20,440 --> 00:40:22,959 if it's not based on EU law, 1074 00:40:22,960 --> 00:40:25,149 and at least that will help, hopefully 1075 00:40:25,150 --> 00:40:26,859 to set global standards. 1076 00:40:28,000 --> 00:40:30,069 We have reached a sunset clause for 1077 00:40:30,070 --> 00:40:32,349 the Safe Harbor Declaration, so adequacy 1078 00:40:32,350 --> 00:40:34,539 ratings of the European Union vis-a-vis 1079 00:40:34,540 --> 00:40:36,969 such states or sectors safe harbor 1080 00:40:36,970 --> 00:40:38,649 vis a vis the U.S. market or U.S. 1081 00:40:38,650 --> 00:40:40,929 companies need to be repealed 1082 00:40:40,930 --> 00:40:43,749 after a certain timeframe 1083 00:40:43,750 --> 00:40:45,999 after this regulation get into force. 1084 00:40:46,000 --> 00:40:48,339 We have blocked the proposals 1085 00:40:48,340 --> 00:40:50,439 to introduce binding corporate rules for 1086 00:40:50,440 --> 00:40:52,629 processes because we see, 1087 00:40:52,630 --> 00:40:54,519 of course, this has to be in the hand of 1088 00:40:54,520 --> 00:40:56,619 the controllers of those 1089 00:40:56,620 --> 00:40:58,989 companies dealing with the consumers 1090 00:40:58,990 --> 00:41:00,369 or the citizens. 1091 00:41:00,370 --> 00:41:02,979 And we introduced at least 1092 00:41:02,980 --> 00:41:05,229 a general framework for whistleblower 1093 00:41:05,230 --> 00:41:07,299 protection in this 1094 00:41:07,300 --> 00:41:08,829 data protection regulation. 1095 00:41:08,830 --> 00:41:11,409 That's an important step and hopefully 1096 00:41:11,410 --> 00:41:13,389 an example for other areas 1097 00:41:14,590 --> 00:41:16,689 and what we achieved, 1098 00:41:16,690 --> 00:41:18,219 and that's quite important. 1099 00:41:18,220 --> 00:41:20,379 We achieved fines up to five percent of 1100 00:41:20,380 --> 00:41:22,359 the global annual turnover in the 1101 00:41:22,360 --> 00:41:23,859 preliminary draft of the European 1102 00:41:23,860 --> 00:41:25,519 Commission. It was up to four percent, 1103 00:41:25,520 --> 00:41:27,519 then watered down to two percent after 1104 00:41:27,520 --> 00:41:29,529 the American Chamber of Commerce did 1105 00:41:29,530 --> 00:41:30,999 heavy lobbying on the European 1106 00:41:31,000 --> 00:41:31,939 Commission. 1107 00:41:31,940 --> 00:41:34,119 European Parliament now lifted 1108 00:41:34,120 --> 00:41:36,219 it up to five percent of global annual 1109 00:41:36,220 --> 00:41:39,099 turnover. That's quite significant. 1110 00:41:39,100 --> 00:41:41,679 At least half of what companies 1111 00:41:41,680 --> 00:41:44,289 can be fined to 1112 00:41:44,290 --> 00:41:46,479 them with competition law. 1113 00:41:46,480 --> 00:41:48,729 And that's quite a heavy thing 1114 00:41:48,730 --> 00:41:50,469 if you get into trouble with European 1115 00:41:50,470 --> 00:41:52,179 competition law. 1116 00:41:52,180 --> 00:41:54,279 So on the core issues, we 1117 00:41:54,280 --> 00:41:56,229 have to say that there was not such a 1118 00:41:56,230 --> 00:41:59,649 huge impact, but we managed to already 1119 00:41:59,650 --> 00:42:01,869 before the Snowden revelations bring 1120 00:42:01,870 --> 00:42:04,359 through most of the core issues. 1121 00:42:04,360 --> 00:42:06,459 And I think that now it's up 1122 00:42:06,460 --> 00:42:09,789 to the ongoing debates. 1123 00:42:09,790 --> 00:42:12,009 What of this of this position 1124 00:42:12,010 --> 00:42:13,929 of the European Parliament will prevail 1125 00:42:13,930 --> 00:42:15,849 in the negotiations with the member 1126 00:42:15,850 --> 00:42:17,590 states and the council. 1127 00:42:19,180 --> 00:42:21,129 So the overall result in the European 1128 00:42:21,130 --> 00:42:23,259 Parliament is for sure a very 1129 00:42:23,260 --> 00:42:24,759 good compromise. 1130 00:42:24,760 --> 00:42:26,439 It's compared to the lobbying and the 1131 00:42:26,440 --> 00:42:28,509 amendments much better than 1132 00:42:28,510 --> 00:42:30,759 I or many of us have hoped 1133 00:42:30,760 --> 00:42:33,069 for. And that's in 1134 00:42:33,070 --> 00:42:35,199 the view of such a majority 1135 00:42:35,200 --> 00:42:36,999 of conservative and market liberals in 1136 00:42:37,000 --> 00:42:38,259 the European Parliament. By the way, the 1137 00:42:38,260 --> 00:42:39,729 next European Parliament will be even 1138 00:42:39,730 --> 00:42:40,730 worse. 1139 00:42:42,460 --> 00:42:44,739 But this result is quite good. 1140 00:42:44,740 --> 00:42:46,809 It's supported from all political 1141 00:42:46,810 --> 00:42:48,309 groups in the European Parliament. 1142 00:42:49,750 --> 00:42:52,119 Only the right wing extremists 1143 00:42:52,120 --> 00:42:53,589 haven't voted in favor of it because they 1144 00:42:53,590 --> 00:42:55,270 don't vote in favor of anything. 1145 00:42:57,370 --> 00:42:59,709 But it's, of course, also understandable 1146 00:42:59,710 --> 00:43:01,779 that civil 1147 00:43:01,780 --> 00:43:03,939 rights activists like was 1148 00:43:03,940 --> 00:43:06,009 Airdrie and those here cannot be 1149 00:43:06,010 --> 00:43:06,909 100 percent happy. 1150 00:43:06,910 --> 00:43:09,309 I'm too not happy 100 1151 00:43:09,310 --> 00:43:11,739 percent, but I think that others 1152 00:43:11,740 --> 00:43:13,840 are even less happier than happy than we. 1153 00:43:15,070 --> 00:43:16,449 So what's next? 1154 00:43:16,450 --> 00:43:17,589 We're waiting for the Council of 1155 00:43:17,590 --> 00:43:20,079 Ministers to adopt their position. 1156 00:43:20,080 --> 00:43:21,789 It's going round in circles in the 1157 00:43:21,790 --> 00:43:23,859 council because there is 1158 00:43:23,860 --> 00:43:26,169 since two years now a debate going 1159 00:43:26,170 --> 00:43:28,629 on without any real results. 1160 00:43:28,630 --> 00:43:31,059 Some helpful allies of France, Poland, 1161 00:43:31,060 --> 00:43:33,789 Austria and Greece companies, 1162 00:43:33,790 --> 00:43:36,009 companies, member states in 1163 00:43:36,010 --> 00:43:38,889 which those debates take place. 1164 00:43:38,890 --> 00:43:41,469 And at least in Poland, the 1165 00:43:41,470 --> 00:43:43,659 Acta debates 1166 00:43:43,660 --> 00:43:45,339 have really changed something in the 1167 00:43:45,340 --> 00:43:46,900 political landscape. 1168 00:43:48,370 --> 00:43:50,469 A bit disappointing is that Germany is 1169 00:43:50,470 --> 00:43:52,719 not in the round of these allies 1170 00:43:52,720 --> 00:43:54,579 in favor of data protection, but one of 1171 00:43:54,580 --> 00:43:56,649 the delaying countries, together 1172 00:43:56,650 --> 00:43:58,629 with companies like the U.K., Denmark, 1173 00:43:58,630 --> 00:44:00,190 Hungary and Slovenia, 1174 00:44:02,890 --> 00:44:05,319 which don't want the regulation 1175 00:44:05,320 --> 00:44:08,169 at all. But Germany is one of those. 1176 00:44:08,170 --> 00:44:10,119 Some others also saying there are lots of 1177 00:44:10,120 --> 00:44:12,189 questions and they are 1178 00:44:12,190 --> 00:44:14,709 saying since two years without proposing 1179 00:44:14,710 --> 00:44:16,809 alternatives, that's diplomat speak 1180 00:44:16,810 --> 00:44:18,489 for delay until this debt. 1181 00:44:19,600 --> 00:44:21,759 So what we can see is now 1182 00:44:21,760 --> 00:44:24,249 that the council will turn its rounds 1183 00:44:24,250 --> 00:44:26,739 again and again, and the question is 1184 00:44:26,740 --> 00:44:29,079 what scrutiny we will have towards 1185 00:44:29,080 --> 00:44:30,849 the EU governments, the member states, 1186 00:44:30,850 --> 00:44:33,459 governments with regard to the activity 1187 00:44:33,460 --> 00:44:35,799 in the European Council of Ministers. 1188 00:44:35,800 --> 00:44:37,389 If it were got a good data protection 1189 00:44:37,390 --> 00:44:39,069 reform or not. 1190 00:44:39,070 --> 00:44:41,139 The big picture European 1191 00:44:41,140 --> 00:44:43,209 data protection reform will not solve 1192 00:44:43,210 --> 00:44:45,399 all the issues, but a level 1193 00:44:45,400 --> 00:44:47,679 playing field on the whole European 1194 00:44:47,680 --> 00:44:49,779 markets and as a market location 1195 00:44:49,780 --> 00:44:51,999 principle for the global 1196 00:44:52,000 --> 00:44:54,399 market and better data control 1197 00:44:54,400 --> 00:44:56,799 for us is something 1198 00:44:56,800 --> 00:44:58,989 significant. We can win with it. 1199 00:44:58,990 --> 00:45:00,969 With regard to the intelligence 1200 00:45:00,970 --> 00:45:03,129 surveillance, I really 1201 00:45:03,130 --> 00:45:05,139 recommend to watch out for the EPP 1202 00:45:05,140 --> 00:45:07,089 inquiry. So the European Parliament's 1203 00:45:07,090 --> 00:45:09,339 inquiry on the mass surveillance on EU 1204 00:45:09,340 --> 00:45:12,099 citizens, which I am coordinating 1205 00:45:12,100 --> 00:45:13,929 together with some other members of the 1206 00:45:13,930 --> 00:45:16,569 European Parliament, and we were present 1207 00:45:16,570 --> 00:45:18,879 or vote our report in January 1208 00:45:18,880 --> 00:45:21,009 2014. So next month's end of next 1209 00:45:21,010 --> 00:45:23,319 month, we will start the voting 1210 00:45:23,320 --> 00:45:25,869 procedure on that and we'll be workshop 1211 00:45:25,870 --> 00:45:28,149 on day three tomorrow at the same 1212 00:45:28,150 --> 00:45:30,579 time as this lot is at the noisy 1213 00:45:30,580 --> 00:45:31,690 square assembly. 1214 00:45:33,880 --> 00:45:35,589 What do we need this joint effort for 1215 00:45:35,590 --> 00:45:38,289 unity kabab capabilities? 1216 00:45:38,290 --> 00:45:40,659 I think that there are needs to be 1217 00:45:40,660 --> 00:45:42,249 initiative. The whole stack, from 1218 00:45:42,250 --> 00:45:44,439 processor design to open software 1219 00:45:44,440 --> 00:45:46,779 of source and a free, open 1220 00:45:46,780 --> 00:45:48,999 approach helps security for 1221 00:45:49,000 --> 00:45:51,549 sure. That is what I also learned 1222 00:45:51,550 --> 00:45:53,799 with Rudy's talk 1223 00:45:53,800 --> 00:45:55,719 on encryption. 1224 00:45:55,720 --> 00:45:58,449 I think we need to fight for open source. 1225 00:45:58,450 --> 00:46:00,699 What we also need is a digital new deal. 1226 00:46:00,700 --> 00:46:02,799 We need to invest in privacy, we need 1227 00:46:02,800 --> 00:46:04,869 to invest into alternatives, and that's 1228 00:46:04,870 --> 00:46:06,249 something we need to demand from 1229 00:46:06,250 --> 00:46:08,109 politicians also. 1230 00:46:08,110 --> 00:46:10,329 And at the end, it's about quite 1231 00:46:10,330 --> 00:46:11,799 a huge thing for democracy. 1232 00:46:11,800 --> 00:46:13,209 It's about safeguarding our 1233 00:46:13,210 --> 00:46:15,309 self-determination, not only 1234 00:46:15,310 --> 00:46:17,379 self-determination as citizens in a 1235 00:46:17,380 --> 00:46:19,719 free democracy and a rule 1236 00:46:19,720 --> 00:46:21,880 of law based democracies, 1237 00:46:23,050 --> 00:46:25,209 at least here in Europe, in the US, 1238 00:46:26,380 --> 00:46:28,869 anywhere in the world, and 1239 00:46:28,870 --> 00:46:30,939 also as consumers, as 1240 00:46:30,940 --> 00:46:33,369 consumers in a global market, 1241 00:46:33,370 --> 00:46:35,499 which is more and more taking our 1242 00:46:35,500 --> 00:46:37,929 self-determination away 1243 00:46:37,930 --> 00:46:40,029 because of lack of enforcement 1244 00:46:40,030 --> 00:46:41,049 of privacy rules. 1245 00:46:41,050 --> 00:46:43,029 And that's quite fundamental. 1246 00:46:43,030 --> 00:46:45,249 So what we need is such 1247 00:46:45,250 --> 00:46:47,379 a reform as a start for a digital 1248 00:46:47,380 --> 00:46:49,479 declaration of Independence. 1249 00:46:49,480 --> 00:46:51,549 We need someone to start with 1250 00:46:51,550 --> 00:46:54,129 and this is, of course, 1251 00:46:54,130 --> 00:46:56,259 a start. And we not we 1252 00:46:56,260 --> 00:46:58,269 do not have the majority on a global 1253 00:46:58,270 --> 00:47:00,369 level. If you look at the global level, 1254 00:47:00,370 --> 00:47:03,189 there is a majority of states 1255 00:47:03,190 --> 00:47:05,799 repressive, non-democratic. 1256 00:47:05,800 --> 00:47:07,959 It is completely naive 1257 00:47:07,960 --> 00:47:09,879 to believe that we will manage to get 1258 00:47:09,880 --> 00:47:11,739 global standards done today. 1259 00:47:11,740 --> 00:47:14,169 We need to fight for standards on 1260 00:47:14,170 --> 00:47:16,539 supranational, supranational level. 1261 00:47:16,540 --> 00:47:18,639 We need to fight for standards 1262 00:47:18,640 --> 00:47:20,499 like the European Data Protection Reform 1263 00:47:20,500 --> 00:47:22,539 to get it done on the global level and to 1264 00:47:22,540 --> 00:47:24,669 get pressure on other global 1265 00:47:24,670 --> 00:47:25,599 players. 1266 00:47:25,600 --> 00:47:27,639 And we have the power here in Europe. 1267 00:47:27,640 --> 00:47:29,019 We still have the majority. 1268 00:47:29,020 --> 00:47:30,699 It could change, but that's what we need 1269 00:47:30,700 --> 00:47:32,859 to work on and we have 1270 00:47:32,860 --> 00:47:34,539 privacy activists around the world 1271 00:47:34,540 --> 00:47:37,269 watching us watching the European Union. 1272 00:47:37,270 --> 00:47:39,369 We got letters from the huge civil 1273 00:47:39,370 --> 00:47:41,349 liberties group and northern and southern 1274 00:47:41,350 --> 00:47:43,419 America to go on to 1275 00:47:43,420 --> 00:47:45,639 go ahead because they believe 1276 00:47:45,640 --> 00:47:47,799 it's only the European Union who could do 1277 00:47:47,800 --> 00:47:50,079 a step, a significant step to improve 1278 00:47:50,080 --> 00:47:52,239 the legal framework for data protection. 1279 00:47:52,240 --> 00:47:54,639 And it's the best chance we get today. 1280 00:47:54,640 --> 00:47:56,769 And last 1281 00:47:56,770 --> 00:47:58,899 but not least, it's a race against the 1282 00:47:58,900 --> 00:48:00,669 clock forum. 1283 00:48:00,670 --> 00:48:03,549 Shopping takes place, as I said in 1284 00:48:03,550 --> 00:48:04,550 the. 1285 00:48:05,480 --> 00:48:08,089 Fewest cases you can trust 1286 00:48:08,090 --> 00:48:11,059 on your own jurisdiction to be applied 1287 00:48:11,060 --> 00:48:13,429 to be a safeguard for you, 1288 00:48:13,430 --> 00:48:15,739 and it will be even worse, 1289 00:48:15,740 --> 00:48:18,349 which with more and more market opening 1290 00:48:18,350 --> 00:48:21,079 and deregulation approaches like T-TIP, 1291 00:48:21,080 --> 00:48:23,089 the Transatlantic Trade and Investment 1292 00:48:23,090 --> 00:48:25,639 Partnership, which is not a problem only 1293 00:48:25,640 --> 00:48:27,739 because of data protection, but also 1294 00:48:27,740 --> 00:48:29,629 because of our fundamental rights, data 1295 00:48:29,630 --> 00:48:31,729 protection, privacy. 1296 00:48:31,730 --> 00:48:33,799 And so we need to regulate as soon 1297 00:48:33,800 --> 00:48:36,469 as possible to safeguard 1298 00:48:36,470 --> 00:48:37,699 something for the future. 1299 00:48:37,700 --> 00:48:39,829 And as I said, parliament and council in 1300 00:48:39,830 --> 00:48:41,479 the European Union will both decide in 1301 00:48:41,480 --> 00:48:44,269 spring 2014 on significant 1302 00:48:44,270 --> 00:48:45,259 waypoints. 1303 00:48:45,260 --> 00:48:47,929 So I ask you all to get active 1304 00:48:47,930 --> 00:48:48,930 right now. 1305 00:48:49,730 --> 00:48:50,780 And it's starting today, 1306 00:48:52,400 --> 00:48:54,049 right after this talk, there will be a 1307 00:48:54,050 --> 00:48:55,819 demonstration freedom, not fear. 1308 00:48:55,820 --> 00:48:58,279 I was asked to just invite 1309 00:48:58,280 --> 00:49:00,829 all of you to get to the entrance and 1310 00:49:00,830 --> 00:49:03,230 have a short protest of one hour 1311 00:49:04,370 --> 00:49:06,800 for privacy outside of the Congress. 1312 00:49:20,870 --> 00:49:21,809 Great, thank you. 1313 00:49:21,810 --> 00:49:23,959 Yeah, that was very insightful. 1314 00:49:23,960 --> 00:49:25,549 I can see that we have a bunch of 1315 00:49:25,550 --> 00:49:27,079 questions, so we're going to open now the 1316 00:49:27,080 --> 00:49:29,299 floor for interaction from you guys, 1317 00:49:29,300 --> 00:49:30,619 so we'll take first. 1318 00:49:31,760 --> 00:49:33,649 Microphone number two. 1319 00:49:33,650 --> 00:49:35,539 Oh, thank you. 1320 00:49:35,540 --> 00:49:37,669 I appreciate your work, and I thank you 1321 00:49:37,670 --> 00:49:39,199 very much for your efforts. 1322 00:49:39,200 --> 00:49:41,389 And I see it as a 1323 00:49:41,390 --> 00:49:43,489 as a big work to increase 1324 00:49:43,490 --> 00:49:44,509 our freedom. 1325 00:49:44,510 --> 00:49:45,620 And so 1326 00:49:46,880 --> 00:49:49,189 most people think that 1327 00:49:49,190 --> 00:49:51,349 that that your work in the European 1328 00:49:51,350 --> 00:49:53,299 Parliament just produce more rules for 1329 00:49:53,300 --> 00:49:55,399 us. So I think 1330 00:49:55,400 --> 00:49:57,259 the big chance would be here to make 1331 00:49:57,260 --> 00:49:59,269 everything easier to make very strict 1332 00:49:59,270 --> 00:50:01,369 laws of data protection, and this is 1333 00:50:01,370 --> 00:50:03,079 good for the people to understand them. 1334 00:50:03,080 --> 00:50:05,239 And so you get the support of the people 1335 00:50:05,240 --> 00:50:06,799 in the countries. So this is the big 1336 00:50:06,800 --> 00:50:07,819 chance. 1337 00:50:07,820 --> 00:50:09,680 Then second point is 1338 00:50:10,990 --> 00:50:13,339 our our right to access 1339 00:50:13,340 --> 00:50:15,529 our own data from my side would 1340 00:50:15,530 --> 00:50:17,599 be very clear to a demand to the 1341 00:50:17,600 --> 00:50:19,699 companies to not 1342 00:50:19,700 --> 00:50:21,979 only give the authorities a backdoor 1343 00:50:21,980 --> 00:50:24,109 in their systems, but to give me a front 1344 00:50:24,110 --> 00:50:26,299 door in the systems so 1345 00:50:26,300 --> 00:50:28,879 that I can see what 1346 00:50:28,880 --> 00:50:31,279 as the demands of what data 1347 00:50:31,280 --> 00:50:33,439 is stored for my next satellite. 1348 00:50:33,440 --> 00:50:36,679 And if this is too much work for a bakery 1349 00:50:36,680 --> 00:50:38,899 to provide this, then 1350 00:50:38,900 --> 00:50:41,420 they shouldn't store my data and. 1351 00:50:45,860 --> 00:50:48,139 And you said that there is a 1352 00:50:48,140 --> 00:50:49,849 decision to make it opt out in the 1353 00:50:49,850 --> 00:50:51,919 systems I've worked in the 1354 00:50:51,920 --> 00:50:54,079 in the direct marketing business 1355 00:50:54,080 --> 00:50:55,080 when someone 1356 00:50:56,180 --> 00:50:57,079 answers on this. 1357 00:50:57,080 --> 00:50:59,239 Then you have the the OK 1358 00:50:59,240 --> 00:51:01,339 that this address is active and 1359 00:51:01,340 --> 00:51:03,649 then the spam increases in this 1360 00:51:03,650 --> 00:51:06,409 way. So the opt out 1361 00:51:06,410 --> 00:51:08,209 should be mandatory with the deletion of 1362 00:51:08,210 --> 00:51:10,639 all the data that are stored there. 1363 00:51:10,640 --> 00:51:12,799 And most of the 1364 00:51:12,800 --> 00:51:15,289 direct marketing agencies are very small. 1365 00:51:15,290 --> 00:51:17,509 So this number of employees that 1366 00:51:17,510 --> 00:51:19,969 you're proposed there will never apply 1367 00:51:19,970 --> 00:51:21,649 for a system that they should have a data 1368 00:51:21,650 --> 00:51:23,629 protection commissioner because they a 1369 00:51:23,630 --> 00:51:24,569 small agency. 1370 00:51:24,570 --> 00:51:26,929 So put this number down, please. 1371 00:51:26,930 --> 00:51:28,519 Thank you for your thoughts. 1372 00:51:28,520 --> 00:51:29,520 Thank you. 1373 00:51:33,030 --> 00:51:35,309 I would I would like to to answer 1374 00:51:35,310 --> 00:51:37,019 just shortly. 1375 00:51:37,020 --> 00:51:38,639 You have seen that we change the number 1376 00:51:38,640 --> 00:51:40,169 of employees to the number of data 1377 00:51:40,170 --> 00:51:41,939 subjects, so that would include those 1378 00:51:41,940 --> 00:51:44,199 smaller companies and all 1379 00:51:44,200 --> 00:51:45,779 the rest. I completely agree with what 1380 00:51:45,780 --> 00:51:47,279 you said. Thank you very much. 1381 00:51:47,280 --> 00:51:48,359 All right. Thank you. 1382 00:51:48,360 --> 00:51:50,219 We'll take one question from online. 1383 00:51:51,680 --> 00:51:53,989 Question from IAC. 1384 00:51:53,990 --> 00:51:56,479 What can Parliament do against passive 1385 00:51:56,480 --> 00:51:59,149 or active sabotage by commission 1386 00:51:59,150 --> 00:52:01,009 and council, for example, through 1387 00:52:01,010 --> 00:52:03,229 international agreements, for 1388 00:52:03,230 --> 00:52:04,729 instance, like in the current 1389 00:52:04,730 --> 00:52:05,730 surveillance hearing? 1390 00:52:08,950 --> 00:52:11,349 So I understand it's about international 1391 00:52:11,350 --> 00:52:13,419 agreements passed through by European 1392 00:52:13,420 --> 00:52:15,369 Commission and European Council or the 1393 00:52:15,370 --> 00:52:17,139 Council of Europe, it comes Council of 1394 00:52:17,140 --> 00:52:18,249 the European Union. So 1395 00:52:20,170 --> 00:52:22,149 international agreements like on 1396 00:52:22,150 --> 00:52:24,849 passenger name records like on Swift's 1397 00:52:24,850 --> 00:52:27,129 banking data have 1398 00:52:27,130 --> 00:52:29,439 been concluded to 1399 00:52:29,440 --> 00:52:31,689 transfer of personal data 1400 00:52:31,690 --> 00:52:33,999 between the European Union and the U.S.. 1401 00:52:34,000 --> 00:52:35,559 International agreement or European 1402 00:52:35,560 --> 00:52:37,779 agreements, exist for data sharing inside 1403 00:52:37,780 --> 00:52:39,339 the European Union. 1404 00:52:39,340 --> 00:52:40,959 The European Parliament has played a very 1405 00:52:40,960 --> 00:52:43,599 important role in that safeguarding 1406 00:52:43,600 --> 00:52:45,669 redress opportunities and 1407 00:52:45,670 --> 00:52:47,739 proportionality with 1408 00:52:47,740 --> 00:52:49,149 regard to data protection. 1409 00:52:49,150 --> 00:52:51,549 Again and again, we rejected 1410 00:52:51,550 --> 00:52:53,259 some of those agreements as the European 1411 00:52:53,260 --> 00:52:55,449 Parliament after the Treaty of Lisbon. 1412 00:52:55,450 --> 00:52:56,799 The European Parliament has to give its 1413 00:52:56,800 --> 00:52:58,599 consent to all of these agreements, 1414 00:52:58,600 --> 00:53:00,489 especially international agreements. 1415 00:53:00,490 --> 00:53:02,559 So nothing can work without 1416 00:53:02,560 --> 00:53:04,599 the European Parliament. So the focus has 1417 00:53:04,600 --> 00:53:06,219 to be on the European Parliament 1418 00:53:06,220 --> 00:53:08,259 representing the interests of European 1419 00:53:08,260 --> 00:53:10,719 citizens of all citizens of humans, 1420 00:53:10,720 --> 00:53:12,819 having a human right on data protection. 1421 00:53:12,820 --> 00:53:15,129 And we need to ask them to do that. 1422 00:53:15,130 --> 00:53:16,959 The problem is that's one field where the 1423 00:53:16,960 --> 00:53:18,759 European Parliament has no influence and 1424 00:53:18,760 --> 00:53:20,889 that is national security 1425 00:53:20,890 --> 00:53:23,259 intelligence because that's only 1426 00:53:23,260 --> 00:53:24,819 reserved for the member states of the 1427 00:53:24,820 --> 00:53:26,499 European Union. It's a black hole of the 1428 00:53:26,500 --> 00:53:28,839 rule of law in the European Union. 1429 00:53:28,840 --> 00:53:31,239 You could even have a drone attack fired 1430 00:53:31,240 --> 00:53:33,820 from Poland to 1431 00:53:35,230 --> 00:53:37,359 Slovenia and justified 1432 00:53:37,360 --> 00:53:39,069 it by national security. 1433 00:53:39,070 --> 00:53:40,509 I think that's unbelievable, but 1434 00:53:40,510 --> 00:53:42,250 therefore we need to change the treaties. 1435 00:53:49,170 --> 00:53:50,489 All right, we'll take questions from 1436 00:53:50,490 --> 00:53:51,490 microphone number one. 1437 00:53:53,310 --> 00:53:54,310 Thanks for the work. 1438 00:53:55,650 --> 00:53:57,899 I was wondering whether you have also 1439 00:53:57,900 --> 00:53:59,999 thought about how to deal with some 1440 00:54:00,000 --> 00:54:01,469 of the situation at the data protection 1441 00:54:01,470 --> 00:54:03,809 authorities because they are vital in the 1442 00:54:03,810 --> 00:54:06,439 overall role to actually enforce 1443 00:54:06,440 --> 00:54:07,649 the regulation. 1444 00:54:07,650 --> 00:54:09,659 And specifically, my concern is that in 1445 00:54:09,660 --> 00:54:11,099 most member states, they are way too 1446 00:54:11,100 --> 00:54:12,149 small. 1447 00:54:12,150 --> 00:54:14,159 And second, they actually have very few 1448 00:54:14,160 --> 00:54:16,259 technical staff who understand internet 1449 00:54:16,260 --> 00:54:17,459 technologies. 1450 00:54:17,460 --> 00:54:19,589 So mostly lawyers, 90 1451 00:54:19,590 --> 00:54:21,929 percent of lawyers there are. 1452 00:54:21,930 --> 00:54:24,209 That makes it really difficult to 1453 00:54:24,210 --> 00:54:25,379 actually address 1454 00:54:27,120 --> 00:54:28,649 the fundamental issues, rather than 1455 00:54:28,650 --> 00:54:30,899 trying to deal with some specific 1456 00:54:30,900 --> 00:54:33,029 urgent cases that show up in the media. 1457 00:54:33,030 --> 00:54:36,149 And on top of that, you mentioned 1458 00:54:36,150 --> 00:54:38,399 sort of more I it in 1459 00:54:38,400 --> 00:54:41,339 in in Europe and privacy for entity, 1460 00:54:41,340 --> 00:54:43,439 and that's also a must for 1461 00:54:43,440 --> 00:54:46,109 most of the Directorate General. 1462 00:54:46,110 --> 00:54:48,329 You don't have computer 1463 00:54:48,330 --> 00:54:50,369 scientists in management positions, so 1464 00:54:50,370 --> 00:54:51,329 you actually have a lack of 1465 00:54:51,330 --> 00:54:52,289 understanding. 1466 00:54:52,290 --> 00:54:53,429 And to make it even worse, 1467 00:54:54,990 --> 00:54:57,569 if you look at the current procurement 1468 00:54:57,570 --> 00:55:00,059 process in the by the U.S.. 1469 00:55:00,060 --> 00:55:02,549 You can't even procure for 1470 00:55:02,550 --> 00:55:04,499 technologies developed, for example, by 1471 00:55:04,500 --> 00:55:07,199 the IDF because those are not recognized. 1472 00:55:07,200 --> 00:55:09,299 And that's even the most of the internet 1473 00:55:09,300 --> 00:55:11,789 technology comes from or W3C. 1474 00:55:11,790 --> 00:55:13,859 So there's a there's the 1475 00:55:13,860 --> 00:55:15,869 more subtle problems that follow after 1476 00:55:15,870 --> 00:55:18,059 that step, and I'm hoping that 1477 00:55:18,060 --> 00:55:20,279 you or someone else also takes 1478 00:55:20,280 --> 00:55:22,349 a look at this and how to actually get 1479 00:55:22,350 --> 00:55:24,209 this to a working system. 1480 00:55:26,380 --> 00:55:28,089 I completely agree to that. 1481 00:55:28,090 --> 00:55:30,429 And there is an ongoing fight for 1482 00:55:30,430 --> 00:55:32,199 the resources of data protection 1483 00:55:32,200 --> 00:55:34,299 authorities, as 1484 00:55:34,300 --> 00:55:35,979 with all the authorities and all 1485 00:55:35,980 --> 00:55:39,039 resources today, it's quite complicated. 1486 00:55:39,040 --> 00:55:41,199 And still the member states have budget 1487 00:55:41,200 --> 00:55:43,299 competence. So it's all about 1488 00:55:43,300 --> 00:55:45,489 the budgets in the member states, 1489 00:55:45,490 --> 00:55:47,739 how good equipped 1490 00:55:47,740 --> 00:55:49,539 data protection authorities are. 1491 00:55:49,540 --> 00:55:51,759 But I think that we really need to work 1492 00:55:51,760 --> 00:55:54,099 of having experts wherever personal 1493 00:55:54,100 --> 00:55:56,049 data processing has taken place and 1494 00:55:56,050 --> 00:55:57,759 therefore the approach of having the data 1495 00:55:57,760 --> 00:55:59,829 protection officer and almost every 1496 00:55:59,830 --> 00:56:01,869 company is a first step, I think. 1497 00:56:07,190 --> 00:56:09,529 All right, we're going a little bit over 1498 00:56:09,530 --> 00:56:11,029 time, Yan, if you don't mind and the 1499 00:56:11,030 --> 00:56:12,439 audience has in mind, you can take a few 1500 00:56:12,440 --> 00:56:14,569 more questions, OK, maybe one more 1501 00:56:14,570 --> 00:56:15,589 from the I.R.S. 1502 00:56:15,590 --> 00:56:16,590 or Twitter. 1503 00:56:17,220 --> 00:56:19,589 We have one more from IOC. 1504 00:56:19,590 --> 00:56:21,659 Can you estimate how much more 1505 00:56:21,660 --> 00:56:23,939 the voice of one single well-funded 1506 00:56:23,940 --> 00:56:25,889 lobbyist counts compared to, for 1507 00:56:25,890 --> 00:56:27,929 instance, a regular citizens sending an 1508 00:56:27,930 --> 00:56:29,459 email to their representative? 1509 00:56:34,970 --> 00:56:36,799 Very good question, I cannot answer 1510 00:56:36,800 --> 00:56:38,869 completely, but what I know, 1511 00:56:38,870 --> 00:56:41,269 I mean is that the Silicon Valley 1512 00:56:41,270 --> 00:56:43,009 on in Washington, D.C. 1513 00:56:43,010 --> 00:56:45,199 and in Brussels holds one of the biggest 1514 00:56:45,200 --> 00:56:47,719 lobbying resources 1515 00:56:47,720 --> 00:56:48,889 ever. 1516 00:56:48,890 --> 00:56:52,249 They influence completely jurisdiction 1517 00:56:52,250 --> 00:56:54,499 and legislation on both sides 1518 00:56:54,500 --> 00:56:55,669 of the Atlantic. 1519 00:56:55,670 --> 00:56:58,069 And for years we took that as 1520 00:56:58,070 --> 00:57:00,949 something not being critical. 1521 00:57:00,950 --> 00:57:03,049 And I think that we should change because 1522 00:57:03,050 --> 00:57:05,509 they are very huge companies 1523 00:57:05,510 --> 00:57:07,909 and they have quite a lot of resources 1524 00:57:07,910 --> 00:57:09,949 to invest and they don't need to say 1525 00:57:09,950 --> 00:57:11,929 openly what their interest is. 1526 00:57:11,930 --> 00:57:14,239 They just need to fund some things, fund 1527 00:57:14,240 --> 00:57:16,909 some movement, some associations 1528 00:57:16,910 --> 00:57:18,799 or lawyers having specific 1529 00:57:18,800 --> 00:57:19,969 interpretations. 1530 00:57:19,970 --> 00:57:22,879 But if I hear Eric Schmidt saying that 1531 00:57:22,880 --> 00:57:25,549 privacy is an anomaly and 1532 00:57:25,550 --> 00:57:27,769 anonymity is dangerous, 1533 00:57:27,770 --> 00:57:29,869 and this company is one 1534 00:57:29,870 --> 00:57:31,399 of the biggest companies in the world 1535 00:57:31,400 --> 00:57:33,499 investing in research and 1536 00:57:33,500 --> 00:57:36,349 lawyers and associations 1537 00:57:36,350 --> 00:57:38,809 all around the world, then you can see 1538 00:57:38,810 --> 00:57:41,179 how lobbying has an influence, 1539 00:57:41,180 --> 00:57:43,099 has an influence on the actual decision 1540 00:57:43,100 --> 00:57:44,089 making process. 1541 00:57:44,090 --> 00:57:47,509 It's not only in the digital industry, 1542 00:57:47,510 --> 00:57:48,919 but of course you have it with 1543 00:57:48,920 --> 00:57:50,329 pharmaceuticals, you have it with 1544 00:57:50,330 --> 00:57:52,399 tobacco, but it's taking 1545 00:57:52,400 --> 00:57:55,249 place, and that's democracy. 1546 00:57:55,250 --> 00:57:57,379 It's sad that 1547 00:57:57,380 --> 00:57:59,330 it's that way, but what we need is 1548 00:58:00,620 --> 00:58:02,899 a critical public asking 1549 00:58:02,900 --> 00:58:05,259 for transparency and critical 1550 00:58:05,260 --> 00:58:07,609 MEPs or members of Parliament, 1551 00:58:07,610 --> 00:58:09,530 Members of Congress who 1552 00:58:10,700 --> 00:58:13,249 try to follow what is reasonable 1553 00:58:13,250 --> 00:58:15,499 and not only what is said more often. 1554 00:58:16,780 --> 00:58:18,480 OK. William speaking. 1555 00:58:20,310 --> 00:58:22,379 And we'll take the 1556 00:58:22,380 --> 00:58:24,899 gentleman at microphone number four. 1557 00:58:24,900 --> 00:58:25,900 Thank you. 1558 00:58:27,090 --> 00:58:29,459 So we've followed the talk, right? 1559 00:58:29,460 --> 00:58:31,739 Since 1995, there's been a right to 1560 00:58:31,740 --> 00:58:33,749 data privacy in the in the European 1561 00:58:33,750 --> 00:58:35,819 Union, but in 2013 we're sort 1562 00:58:35,820 --> 00:58:38,249 of still talking about whether that right 1563 00:58:38,250 --> 00:58:40,259 is supposed to continue as opposed to how 1564 00:58:40,260 --> 00:58:41,489 implementations of that 1565 00:58:42,550 --> 00:58:44,309 may may work out. 1566 00:58:44,310 --> 00:58:46,439 So I'm asking about how do you 1567 00:58:46,440 --> 00:58:49,139 see possible implementations of 1568 00:58:49,140 --> 00:58:51,239 the rights of whether 1569 00:58:51,240 --> 00:58:53,399 they exist, when they might exist and 1570 00:58:53,400 --> 00:58:55,259 specifically whether any thought has been 1571 00:58:55,260 --> 00:58:57,479 given to an existing 1572 00:58:57,480 --> 00:59:00,209 data protection regime that is 1573 00:59:00,210 --> 00:59:02,519 copyright or way above that 1574 00:59:02,520 --> 00:59:04,619 already is in the 1575 00:59:04,620 --> 00:59:06,509 courts. Like we understand how to work 1576 00:59:06,510 --> 00:59:08,129 this and whether we could apply this to 1577 00:59:08,130 --> 00:59:10,079 personal data that say shows up in all 1578 00:59:10,080 --> 00:59:12,179 these databases of the 1579 00:59:12,180 --> 00:59:13,180 internet companies. 1580 00:59:14,610 --> 00:59:16,769 I didn't get completely the question, but 1581 00:59:16,770 --> 00:59:19,029 I would understand it in a way that 1582 00:59:19,030 --> 00:59:21,089 you used to ask about, 1583 00:59:21,090 --> 00:59:23,189 does the right to privacy right to data 1584 00:59:23,190 --> 00:59:26,309 protection changed significantly or 1585 00:59:26,310 --> 00:59:28,469 is there a way to to really 1586 00:59:28,470 --> 00:59:30,089 better enforce it? 1587 00:59:30,090 --> 00:59:32,279 So the right is more 1588 00:59:32,280 --> 00:59:33,599 of an abstract concept, right? 1589 00:59:33,600 --> 00:59:35,759 But the so the right to privacy is 1590 00:59:35,760 --> 00:59:37,829 like, you know, you have a 1591 00:59:37,830 --> 00:59:38,909 right, but what are you going to do about 1592 00:59:38,910 --> 00:59:41,159 this, this case of this Austrian student 1593 00:59:41,160 --> 00:59:43,319 who is fighting the legal 1594 00:59:43,320 --> 00:59:45,599 battle in Ireland, 1595 00:59:45,600 --> 00:59:47,759 right? But the the process is 1596 00:59:47,760 --> 00:59:49,529 not well understood or well-established. 1597 00:59:49,530 --> 00:59:51,779 Where as for copyright 1598 00:59:51,780 --> 00:59:53,369 infringements, there is already a 1599 00:59:53,370 --> 00:59:54,579 well-established, well understood. 1600 00:59:54,580 --> 00:59:55,619 OK, I got it. 1601 00:59:55,620 --> 00:59:56,670 OK. So 1602 00:59:57,690 --> 00:59:59,759 yeah, it's clear that the 1603 00:59:59,760 --> 01:00:01,379 enforcement is taking place where the 1604 01:00:01,380 --> 01:00:04,049 interests are. So and the interests 1605 01:00:04,050 --> 01:00:05,819 to data protection is only shared by 1606 01:00:05,820 --> 01:00:06,900 consumers and citizens. 1607 01:00:08,820 --> 01:00:11,009 That's different with 1608 01:00:11,010 --> 01:00:12,659 IP enforcement, for example. 1609 01:00:12,660 --> 01:00:14,819 But what I see is 1610 01:00:14,820 --> 01:00:16,619 that there's a general question behind 1611 01:00:16,620 --> 01:00:18,509 which is enforcement in the digital 1612 01:00:18,510 --> 01:00:19,529 environment. 1613 01:00:19,530 --> 01:00:21,599 And that is something which 1614 01:00:21,600 --> 01:00:24,329 we need to talk about, which we need to 1615 01:00:24,330 --> 01:00:26,519 approach in a way that it's not going 1616 01:00:26,520 --> 01:00:29,189 back to nationalistic 1617 01:00:29,190 --> 01:00:31,349 or fragment tithing 1618 01:00:31,350 --> 01:00:34,349 of the internet environment and of 1619 01:00:34,350 --> 01:00:37,139 arbitrary blocking of 1620 01:00:37,140 --> 01:00:39,299 content, for example. 1621 01:00:39,300 --> 01:00:41,519 But in the direction of clear rules 1622 01:00:41,520 --> 01:00:43,889 to be applied by 1623 01:00:44,940 --> 01:00:47,099 data controllers and to be asked for 1624 01:00:47,100 --> 01:00:49,739 by data subjects in an environment 1625 01:00:49,740 --> 01:00:51,989 like a common market or 1626 01:00:51,990 --> 01:00:54,659 even in 1627 01:00:54,660 --> 01:00:57,869 an extraterritorial approach where 1628 01:00:57,870 --> 01:00:59,909 a territory where the server is, for 1629 01:00:59,910 --> 01:01:01,799 example, has to be regulated. 1630 01:01:01,800 --> 01:01:03,299 So that's the way, how we do it. 1631 01:01:03,300 --> 01:01:05,729 But the problem is still that 1632 01:01:05,730 --> 01:01:08,279 there's no real concern of 1633 01:01:08,280 --> 01:01:10,679 other entities at the moment 1634 01:01:10,680 --> 01:01:12,809 than citizens and consumers, and 1635 01:01:12,810 --> 01:01:14,070 that we need to change, of course. 1636 01:01:15,170 --> 01:01:16,699 Hey, thank you. 1637 01:01:16,700 --> 01:01:17,720 I think we'll take 1638 01:01:19,130 --> 01:01:21,049 the limit microphone number three and 1639 01:01:21,050 --> 01:01:23,179 then went online and then two and one 1640 01:01:23,180 --> 01:01:25,469 and go round, right? 1641 01:01:25,470 --> 01:01:26,689 All yours. 1642 01:01:26,690 --> 01:01:27,889 Thank you. 1643 01:01:27,890 --> 01:01:29,239 Great. OK. 1644 01:01:29,240 --> 01:01:30,799 I have two questions. 1645 01:01:30,800 --> 01:01:33,049 One is when do we get criminal 1646 01:01:33,050 --> 01:01:34,819 provisions so that we can also get to 1647 01:01:34,820 --> 01:01:35,840 individuals who 1648 01:01:37,940 --> 01:01:40,369 do something against the law 1649 01:01:40,370 --> 01:01:42,469 and make all those extradition treaties 1650 01:01:42,470 --> 01:01:44,749 work for us instead of against us? 1651 01:01:44,750 --> 01:01:47,299 And the second one, 1652 01:01:47,300 --> 01:01:50,059 how about a global approach, something 1653 01:01:50,060 --> 01:01:52,179 rooted in international law like 1654 01:01:52,180 --> 01:01:54,529 a treaty, a digital high seas treaty 1655 01:01:54,530 --> 01:01:56,209 with the court and stuff like that? 1656 01:01:56,210 --> 01:01:58,389 Wouldn't that perhaps solve the problem? 1657 01:01:58,390 --> 01:02:00,829 Most of the resource protection 1658 01:02:00,830 --> 01:02:02,749 problems and stuff like that? 1659 01:02:02,750 --> 01:02:04,399 Very good questions. 1660 01:02:04,400 --> 01:02:06,679 The first question we 1661 01:02:06,680 --> 01:02:08,269 have criminal law provisions, for 1662 01:02:08,270 --> 01:02:10,159 example, for cybersecurity, we just 1663 01:02:10,160 --> 01:02:11,389 passed it. 1664 01:02:11,390 --> 01:02:13,459 We didn't completely like them 1665 01:02:13,460 --> 01:02:15,649 because of course, they were 1666 01:02:15,650 --> 01:02:17,809 slightly trying 1667 01:02:17,810 --> 01:02:20,059 to criminalize those people 1668 01:02:20,060 --> 01:02:21,060 who gather here. 1669 01:02:21,860 --> 01:02:24,289 But what they are helpful 1670 01:02:24,290 --> 01:02:27,049 against is, for example, 1671 01:02:27,050 --> 01:02:29,479 access to information systems also 1672 01:02:29,480 --> 01:02:32,419 by such states, entities 1673 01:02:32,420 --> 01:02:34,609 or by companies 1674 01:02:34,610 --> 01:02:35,689 towards other companies. 1675 01:02:35,690 --> 01:02:37,429 So spying, for example. 1676 01:02:37,430 --> 01:02:39,169 And I think that should be used by us 1677 01:02:39,170 --> 01:02:41,239 more. We should turn around 1678 01:02:41,240 --> 01:02:43,529 the table and say, Listen, 1679 01:02:43,530 --> 01:02:46,519 the Q does cyberattacks 1680 01:02:46,520 --> 01:02:48,649 on the burger com system in Belgium, 1681 01:02:48,650 --> 01:02:50,719 and they should be punished for that. 1682 01:02:50,720 --> 01:02:51,859 I mean, there should be a criminal 1683 01:02:51,860 --> 01:02:52,759 procedure against 1684 01:02:52,760 --> 01:02:54,590 Eric Schmidt about the terrorist. 1685 01:02:58,840 --> 01:03:00,399 I didn't get that. 1686 01:03:00,400 --> 01:03:02,859 Eric Smith thought the terrorists. 1687 01:03:02,860 --> 01:03:04,989 Yeah, yeah, OK. Terrorism, I don't 1688 01:03:04,990 --> 01:03:07,329 like that term. But anyway, the second 1689 01:03:07,330 --> 01:03:08,330 thing? 1690 01:03:10,000 --> 01:03:11,000 I forgot already. 1691 01:03:12,370 --> 01:03:14,439 International treaties, of course. 1692 01:03:14,440 --> 01:03:16,809 Yeah, I mean, I'm completely in favor of 1693 01:03:16,810 --> 01:03:18,399 international approach. 1694 01:03:18,400 --> 01:03:21,009 At the end, I would like to have 1695 01:03:21,010 --> 01:03:22,689 an international treaty of fundamental 1696 01:03:22,690 --> 01:03:24,819 rights, which is completely enforced 1697 01:03:24,820 --> 01:03:26,949 everywhere, consistently 1698 01:03:26,950 --> 01:03:27,879 applied and so on. 1699 01:03:27,880 --> 01:03:29,769 But I just told you that this will not 1700 01:03:29,770 --> 01:03:31,599 happen. I mean, we have the United 1701 01:03:31,600 --> 01:03:33,849 Nations and we have a human 1702 01:03:33,850 --> 01:03:36,169 rights culture, but I mean, 1703 01:03:36,170 --> 01:03:38,889 in in practical meaning, 1704 01:03:38,890 --> 01:03:40,389 it doesn't mean anything at the moment, 1705 01:03:40,390 --> 01:03:43,029 you know? So the problem is that we 1706 01:03:43,030 --> 01:03:46,449 need to get rule of law 1707 01:03:46,450 --> 01:03:48,699 jurisdiction, which is 1708 01:03:48,700 --> 01:03:50,769 applicable in practical meanings 1709 01:03:50,770 --> 01:03:53,139 where we have redress possibilities 1710 01:03:53,140 --> 01:03:55,689 and real activities to be taken. 1711 01:03:55,690 --> 01:03:57,759 And that's possible at the moment 1712 01:03:57,760 --> 01:04:00,159 in some areas of law of 1713 01:04:00,160 --> 01:04:01,209 legislation. 1714 01:04:01,210 --> 01:04:02,919 And we should use the opportunities we 1715 01:04:02,920 --> 01:04:05,019 have to then at the end to build the 1716 01:04:05,020 --> 01:04:07,239 pressure for international agreements 1717 01:04:07,240 --> 01:04:08,589 as far as possible. 1718 01:04:08,590 --> 01:04:10,809 I don't think that a different approach 1719 01:04:10,810 --> 01:04:12,999 is possible at the moment. 1720 01:04:13,000 --> 01:04:15,339 If if 1721 01:04:15,340 --> 01:04:18,219 the big powers in politics fail 1722 01:04:18,220 --> 01:04:21,609 to regulate multilaterally, 1723 01:04:21,610 --> 01:04:24,579 important questions for them, like 1724 01:04:24,580 --> 01:04:26,709 external security, 1725 01:04:26,710 --> 01:04:28,809 whatever you know, then we will not 1726 01:04:28,810 --> 01:04:30,579 manage to do that for privacy. 1727 01:04:30,580 --> 01:04:32,739 But we will manage by building up 1728 01:04:32,740 --> 01:04:34,809 the pressure from all around the globe, 1729 01:04:34,810 --> 01:04:36,969 by building out systems 1730 01:04:36,970 --> 01:04:38,980 which work and risk practically 1731 01:04:40,030 --> 01:04:42,459 GIF enforcement and security for 1732 01:04:42,460 --> 01:04:44,140 us as citizens and consumers. 1733 01:04:45,580 --> 01:04:47,709 Thank you, Signal, 1734 01:04:47,710 --> 01:04:49,419 Angel. Do you have a question from our 1735 01:04:49,420 --> 01:04:50,439 online viewers? 1736 01:04:50,440 --> 01:04:52,779 Yes, just a question from IAC. 1737 01:04:52,780 --> 01:04:55,149 How does the upcoming trip 1738 01:04:55,150 --> 01:04:57,309 deregulation undermine privacy 1739 01:04:57,310 --> 01:04:59,949 rights or will make it harder to defend 1740 01:04:59,950 --> 01:05:01,000 and extend them? 1741 01:05:02,730 --> 01:05:04,799 That's a good question, where I can 1742 01:05:04,800 --> 01:05:06,899 just start with a sentence, which I 1743 01:05:06,900 --> 01:05:08,519 forgot to say to the last question, 1744 01:05:08,520 --> 01:05:10,649 because of course, we need to 1745 01:05:10,650 --> 01:05:13,169 also insist on international agreements 1746 01:05:13,170 --> 01:05:14,909 on standards internationally. 1747 01:05:14,910 --> 01:05:16,079 I don't think we should. 1748 01:05:16,080 --> 01:05:18,749 It should exclude each other. 1749 01:05:18,750 --> 01:05:20,579 What we have, for example, at the moment 1750 01:05:20,580 --> 01:05:22,859 is the transatlantic data protection 1751 01:05:22,860 --> 01:05:24,959 framework agreement negotiated 1752 01:05:24,960 --> 01:05:26,279 since two years. 1753 01:05:26,280 --> 01:05:27,869 Since two years, we tried to get the 1754 01:05:27,870 --> 01:05:29,969 United States government to agree 1755 01:05:29,970 --> 01:05:32,279 on the protection of privacy 1756 01:05:32,280 --> 01:05:34,559 for non-U.S. citizens or residents, 1757 01:05:34,560 --> 01:05:36,389 because the Privacy Act only protects 1758 01:05:36,390 --> 01:05:38,489 your citizens and residents and that we 1759 01:05:38,490 --> 01:05:39,749 need to change. We need to have the 1760 01:05:39,750 --> 01:05:41,669 fundamental right, the human right 1761 01:05:43,500 --> 01:05:45,629 notion like it in the EU 1762 01:05:45,630 --> 01:05:47,219 treaty and the EU fundamental rights 1763 01:05:47,220 --> 01:05:48,989 culture into the US law. 1764 01:05:48,990 --> 01:05:51,089 That's what we need to achieve and 1765 01:05:51,090 --> 01:05:52,859 what we tried to achieve in the European 1766 01:05:52,860 --> 01:05:55,169 Parliament. And I think that tied to 1767 01:05:55,170 --> 01:05:57,389 the trade agreement is 1768 01:05:57,390 --> 01:05:59,639 endangering these 1769 01:05:59,640 --> 01:06:00,899 approaches. 1770 01:06:00,900 --> 01:06:03,479 If T-TIP would include debates 1771 01:06:03,480 --> 01:06:05,729 on issues like fundamental rights 1772 01:06:05,730 --> 01:06:06,749 or data protection. 1773 01:06:06,750 --> 01:06:08,879 Therefore, I say that the 1774 01:06:08,880 --> 01:06:11,069 ongoing negotiations should be reduced 1775 01:06:11,070 --> 01:06:13,589 in scope on technical 1776 01:06:13,590 --> 01:06:15,659 standards in many regions, 1777 01:06:15,660 --> 01:06:17,279 but not not there, where it's about 1778 01:06:17,280 --> 01:06:18,869 fundamental rights, for example, data 1779 01:06:18,870 --> 01:06:20,849 protection, because we need to work on 1780 01:06:20,850 --> 01:06:23,129 standards now what T-TIP does 1781 01:06:23,130 --> 01:06:24,869 is mutual recognition. 1782 01:06:24,870 --> 01:06:26,099 What is mutual recognition? 1783 01:06:26,100 --> 01:06:28,199 Mutual recognition says OK, the United 1784 01:06:28,200 --> 01:06:30,149 States says you Europeans. 1785 01:06:30,150 --> 01:06:32,039 If you sell products to our markets, we 1786 01:06:32,040 --> 01:06:33,779 accept that you have your own standards. 1787 01:06:33,780 --> 01:06:35,639 But if we sell products to your markets, 1788 01:06:35,640 --> 01:06:37,109 you have to accept that you have to 1789 01:06:37,110 --> 01:06:38,459 follow our standards. 1790 01:06:38,460 --> 01:06:39,869 So that's not the way, how we do it, 1791 01:06:39,870 --> 01:06:41,939 because that's just a race to the bottom. 1792 01:06:41,940 --> 01:06:43,379 It's undermining the standards which 1793 01:06:43,380 --> 01:06:45,689 exist because it's always a competitive 1794 01:06:45,690 --> 01:06:48,119 disadvantage if you have standards 1795 01:06:48,120 --> 01:06:49,439 and if you have higher standards. 1796 01:06:49,440 --> 01:06:51,689 Because of course, it's always 1797 01:06:51,690 --> 01:06:53,069 a burden for trade. 1798 01:06:53,070 --> 01:06:55,289 It's always a burden for those who 1799 01:06:55,290 --> 01:06:57,359 want to sell the products so that we 1800 01:06:57,360 --> 01:06:58,349 need to get away from. 1801 01:06:58,350 --> 01:07:00,239 And therefore, I ask us all to 1802 01:07:01,470 --> 01:07:03,389 oppose the T-TIP negotiations because I 1803 01:07:03,390 --> 01:07:04,390 don't think it's helpful. 1804 01:07:11,460 --> 01:07:13,109 Great. Thank you. 1805 01:07:13,110 --> 01:07:15,359 Speaker at number 1806 01:07:15,360 --> 01:07:16,360 two. 1807 01:07:16,810 --> 01:07:18,759 Yes, I want to thank you very much for 1808 01:07:18,760 --> 01:07:20,259 the great work you're doing in the 1809 01:07:20,260 --> 01:07:21,699 European Parliament. 1810 01:07:21,700 --> 01:07:24,279 I represent the beekeepers 1811 01:07:24,280 --> 01:07:26,379 in Europe and 1812 01:07:26,380 --> 01:07:28,899 the Green Party in the Parliament 1813 01:07:28,900 --> 01:07:31,329 has helped us win many 1814 01:07:31,330 --> 01:07:33,759 lobbying battles and it's important 1815 01:07:33,760 --> 01:07:34,809 that you're there. 1816 01:07:34,810 --> 01:07:36,159 Thank you so much for that. 1817 01:07:40,850 --> 01:07:43,129 But my question goes back to the 1818 01:07:43,130 --> 01:07:45,439 trade agreement issue, because 1819 01:07:45,440 --> 01:07:47,749 you indicated that we have 1820 01:07:47,750 --> 01:07:49,909 a race against the clock because 1821 01:07:49,910 --> 01:07:52,009 if these trade agreements are in 1822 01:07:52,010 --> 01:07:54,499 place before 1823 01:07:54,500 --> 01:07:56,629 the European regulations are in 1824 01:07:56,630 --> 01:07:58,819 place, then the companies may 1825 01:07:58,820 --> 01:08:01,459 be able to go to an arbitration 1826 01:08:01,460 --> 01:08:04,189 panel and see 1827 01:08:04,190 --> 01:08:06,679 any rules 1828 01:08:06,680 --> 01:08:08,989 instituted after 1829 01:08:08,990 --> 01:08:11,569 the TTIP is in place 1830 01:08:11,570 --> 01:08:13,699 as an unfair trade 1831 01:08:13,700 --> 01:08:16,039 barrier and seek compensation from 1832 01:08:16,040 --> 01:08:17,040 the taxpayers. 1833 01:08:19,340 --> 01:08:21,409 There is an issue, though, that we might. 1834 01:08:21,410 --> 01:08:23,688 We may already be losing this race 1835 01:08:23,689 --> 01:08:25,818 against the clock because the EU has 1836 01:08:25,819 --> 01:08:27,978 already concluded a free trade agreement 1837 01:08:27,979 --> 01:08:29,358 with Canada. 1838 01:08:29,359 --> 01:08:31,669 And as long as these internet 1839 01:08:31,670 --> 01:08:33,949 companies have a significant entity 1840 01:08:33,950 --> 01:08:36,019 in Canada, they may already 1841 01:08:36,020 --> 01:08:39,289 be entitled to such investor protections. 1842 01:08:39,290 --> 01:08:41,358 And as a member of European Parliament, 1843 01:08:41,359 --> 01:08:43,519 I already asked your colleagues because 1844 01:08:43,520 --> 01:08:46,278 they are in the GMO and pesticide 1845 01:08:46,279 --> 01:08:48,858 area, they're probably similarly 1846 01:08:48,859 --> 01:08:49,938 similar problems. 1847 01:08:49,939 --> 01:08:52,339 As a member of the European Parliament 1848 01:08:52,340 --> 01:08:54,528 in the rapporteur position, do you 1849 01:08:54,529 --> 01:08:57,019 have any idea what is in the 1850 01:08:57,020 --> 01:08:58,398 agreement that has already been 1851 01:08:58,399 --> 01:09:00,739 negotiated between Canada and the EU? 1852 01:09:02,930 --> 01:09:04,009 It's it's a problem. 1853 01:09:04,010 --> 01:09:06,769 I mean, we oppose this 1854 01:09:06,770 --> 01:09:09,108 agreement due to the reasons 1855 01:09:09,109 --> 01:09:10,849 you already noticed. 1856 01:09:10,850 --> 01:09:13,188 I think that the investment security 1857 01:09:13,189 --> 01:09:15,079 provisions are the most dangerous for 1858 01:09:15,080 --> 01:09:16,639 democracy worldwide. 1859 01:09:17,870 --> 01:09:20,239 Unfortunately, we as Europeans 1860 01:09:20,240 --> 01:09:22,349 are doing it with so it's so 1861 01:09:22,350 --> 01:09:23,389 states already. 1862 01:09:23,390 --> 01:09:25,759 You mentioned Canada, but there has been 1863 01:09:26,840 --> 01:09:28,909 more in 1864 01:09:28,910 --> 01:09:30,799 equal agreements like the free trade 1865 01:09:30,800 --> 01:09:32,179 agreement with India. 1866 01:09:32,180 --> 01:09:34,549 And I think 1867 01:09:34,550 --> 01:09:36,679 that there's only one opportunity 1868 01:09:36,680 --> 01:09:39,108 to oppose those ideas of invest 1869 01:09:39,109 --> 01:09:41,269 in vessel security provisions in these 1870 01:09:41,270 --> 01:09:43,669 agreements because it just means 1871 01:09:43,670 --> 01:09:45,769 that you reduce the scope of democratic 1872 01:09:45,770 --> 01:09:47,869 decision making in 1873 01:09:47,870 --> 01:09:49,669 in our democratic states. 1874 01:09:49,670 --> 01:09:52,339 And I don't think that this is a valid 1875 01:09:52,340 --> 01:09:54,709 provision. Companies shouldn't have 1876 01:09:54,710 --> 01:09:56,839 a reservation that they can 1877 01:09:56,840 --> 01:09:59,179 say what can be law and what not, 1878 01:09:59,180 --> 01:10:01,579 but it should be the democratic 1879 01:10:01,580 --> 01:10:03,589 debate which should decide about that. 1880 01:10:03,590 --> 01:10:06,139 So in the Canada provisions, 1881 01:10:06,140 --> 01:10:08,059 there are some of these provisions 1882 01:10:08,060 --> 01:10:09,739 already in. It's a problem, and it could 1883 01:10:09,740 --> 01:10:11,509 be a precedent for T-TIP. 1884 01:10:11,510 --> 01:10:13,819 And of course, they will use 1885 01:10:13,820 --> 01:10:15,799 it. And they, by the way, try to 1886 01:10:15,800 --> 01:10:17,629 negotiate they the U.S. 1887 01:10:17,630 --> 01:10:19,879 negotiators in the Canada EU 1888 01:10:19,880 --> 01:10:21,649 negotiations. That's not how it goes all 1889 01:10:21,650 --> 01:10:22,549 the time. 1890 01:10:22,550 --> 01:10:24,829 They know how to negotiate quite good. 1891 01:10:25,850 --> 01:10:28,069 So the issue is 1892 01:10:28,070 --> 01:10:30,439 that there is a majority 1893 01:10:30,440 --> 01:10:32,359 structure, a majority on both sides of 1894 01:10:32,360 --> 01:10:34,729 the Atlantic in favor of it 1895 01:10:34,730 --> 01:10:36,829 because of jobs and growth. 1896 01:10:36,830 --> 01:10:39,079 And that's a debate which is longer than 1897 01:10:39,080 --> 01:10:40,309 what we have right now. 1898 01:10:40,310 --> 01:10:42,529 I mean, we need to think 1899 01:10:42,530 --> 01:10:44,749 about a way 1900 01:10:44,750 --> 01:10:45,889 how we can improve 1901 01:10:47,450 --> 01:10:49,789 awareness for these problems, especially 1902 01:10:49,790 --> 01:10:51,919 with regards to technologies 1903 01:10:51,920 --> 01:10:54,379 and how we can create 1904 01:10:54,380 --> 01:10:55,939 awareness for the political process 1905 01:10:55,940 --> 01:10:56,989 procedures. 1906 01:10:56,990 --> 01:10:59,090 But that that means. 1907 01:11:00,150 --> 01:11:01,379 So, Michael, I'm 1908 01:11:01,380 --> 01:11:03,419 sorry, I don't want there to be a ping 1909 01:11:03,420 --> 01:11:05,579 pong back and forth to allow other people 1910 01:11:05,580 --> 01:11:07,679 to speak and the young man 1911 01:11:07,680 --> 01:11:09,989 at speaker number one, please. 1912 01:11:09,990 --> 01:11:12,179 OK. Hi, and thanks for doing more than 1913 01:11:12,180 --> 01:11:14,549 your job. And the question 1914 01:11:14,550 --> 01:11:16,649 is simple does it apply to 1915 01:11:16,650 --> 01:11:19,409 agencies as well or just companies? 1916 01:11:19,410 --> 01:11:21,539 And how to enforce that in 1917 01:11:21,540 --> 01:11:24,149 the future? Two agencies, yes. 1918 01:11:24,150 --> 01:11:27,029 Which agencies and the 1919 01:11:27,030 --> 01:11:27,569 public? 1920 01:11:27,570 --> 01:11:29,639 It depends on the nature of 1921 01:11:29,640 --> 01:11:30,989 the agency. I mean, 1922 01:11:33,630 --> 01:11:34,719 yeah, public administration. 1923 01:11:34,720 --> 01:11:36,959 OK, so the data protection 1924 01:11:36,960 --> 01:11:39,419 regulation will apply to all public 1925 01:11:39,420 --> 01:11:40,979 administrations, which are not law 1926 01:11:40,980 --> 01:11:43,899 enforcement or national security. 1927 01:11:43,900 --> 01:11:44,900 That's the point. 1928 01:11:48,430 --> 01:11:49,779 For law enforcement, there's the 1929 01:11:49,780 --> 01:11:51,939 directive and for national 1930 01:11:51,940 --> 01:11:53,979 security, as I said, black hole. 1931 01:11:55,600 --> 01:11:58,059 OK, thank you. OK, I'm sorry, I 1932 01:11:58,060 --> 01:12:00,069 have to leave, so thank you very much. 1933 01:12:00,070 --> 01:12:01,899 Thank you so much, Dan. 1934 01:12:08,540 --> 01:12:10,579 Thank you all for your questions. 1935 01:12:10,580 --> 01:12:12,409 I guess it's break time to make sure your 1936 01:12:12,410 --> 01:12:13,410 take your things with you.