Risk
1/30/2012
04:43 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

EU Data Rules Worse Than SOPA?

European Union's proposed "right to be forgotten" data privacy rule threatens free speech and online business, critics argue.

Last week, the European Commission (EC) released a draft revision of its 1995 data protection rules for the stated purpose of strengthening online privacy rights and Europe's digital economy. But the rules threaten the viability of data-driven businesses, from Google to credit bureaus, critics contend.

The EC says that a single streamlined set of rules will save businesses billions in administrative work. The rules require: notification of national data authorities as soon as possible following a serious data breach; explicit rather than assumed consent for data collection; easier consumer access to data and easier transfer of that data to other providers; and support for a "right to be forgotten," which gives consumers the option under some circumstances to have their data deleted from third-party service providers.

The fine for violating these European Union (EU) data rules is substantial: up to 1 million Euros or up to 2% of global annual revenue. Under this regime, Google's collection of Wi-Fi network data through its Street View cars, disclosed in 2010, could have cost the company $586 million, had the EU chosen to punish the company to the full extent of the law.

[ Sometimes data protection means less privacy. Read Stolen iPhone Saved By iCloud. ]

Google helped lead the protest against SOPA and PIPA, U.S. legislation that would have harmed the Internet and forced Internet companies to protect content companies. The EU data rules don't threaten the flow of information in the same way. Rather, they threaten the existence of information online, through rules like Article 17, the "right to be forgotten and to erasure," and Article 20, which forbids the exclusive use of automated data processing for determining, among other things, creditworthiness or work performance.

Try to imagine an information economy starved of information. The concept clearly has potential problems.

"Article 17 will give EU residents an unprecedented inalienable right to control and delete facts that were once voluntarily communicated by the subject," explained Jane Yakowitz, visiting assistant professor of Brooklyn Law School, in an online post.

EU justice commissioner Viviane Reding described that right thus in a statement last week: "If an individual no longer wants his personal data to be processed or stored by a data controller, and if there is no legitimate reason for keeping it, the data should be removed from their system."

Article 17 has some limits. The proposed rules recognize that people can't have the right to erase history, hinder free expression, harm public health, or impede scientific research with their desire to delete their data.

But Yakowitz argues the limits are undermined by restrictive wording and draconian fines.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
1/31/2012 | 5:36:07 PM
re: EU Data Rules Worse Than SOPA?
There is a chance this proposal will be altered somewhat as it goes through the legislative process. More comparing the rules to SOPA from Time:
http://techland.time.com/2012/...
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Tony A
50%
50%
Tony A,
User Rank: Apprentice
1/31/2012 | 9:01:50 PM
re: EU Data Rules Worse Than SOPA?
Nowhere in this article do I see any hint of an argument for why the "right to be forgotten" would conflict with freedom of expression. It conflicts with the self-interest of ISP's, search and social networking sites to utilize your content for their profit. These companies have lots of ways of making money without mining my posts for monetary gain. They also benefit from the general carelessness with which people offer and leave personal information online, which wouldn't change even if the EC law is enacted. They benefit from people's laziness in utilizing opt-out privileges. They benefit from court rulings that give them access to data that does no more than briefly pass through a server on the way to another desitnation. They have no inalienable right to any of this. If they want to provide a service and reap some ancillary benefit from it, fine, but their ability to do this does not give then any valid claim to the use of a post. Online content posted by users of a service should be protected by international copyright like every other original creation. That means that basically the only uses of it that can be made without my explicit permission are under the "fair use" convention, e.g., to quote it or use it for educational purposes. The right to profit from it does not exist. Go, EU!
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: just wondering...Thanx
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.