Risk
1/30/2012
04:43 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

EU Data Rules Worse Than SOPA?

European Union's proposed "right to be forgotten" data privacy rule threatens free speech and online business, critics argue.

Last week, the European Commission (EC) released a draft revision of its 1995 data protection rules for the stated purpose of strengthening online privacy rights and Europe's digital economy. But the rules threaten the viability of data-driven businesses, from Google to credit bureaus, critics contend.

The EC says that a single streamlined set of rules will save businesses billions in administrative work. The rules require: notification of national data authorities as soon as possible following a serious data breach; explicit rather than assumed consent for data collection; easier consumer access to data and easier transfer of that data to other providers; and support for a "right to be forgotten," which gives consumers the option under some circumstances to have their data deleted from third-party service providers.

The fine for violating these European Union (EU) data rules is substantial: up to 1 million Euros or up to 2% of global annual revenue. Under this regime, Google's collection of Wi-Fi network data through its Street View cars, disclosed in 2010, could have cost the company $586 million, had the EU chosen to punish the company to the full extent of the law.

[ Sometimes data protection means less privacy. Read Stolen iPhone Saved By iCloud. ]

Google helped lead the protest against SOPA and PIPA, U.S. legislation that would have harmed the Internet and forced Internet companies to protect content companies. The EU data rules don't threaten the flow of information in the same way. Rather, they threaten the existence of information online, through rules like Article 17, the "right to be forgotten and to erasure," and Article 20, which forbids the exclusive use of automated data processing for determining, among other things, creditworthiness or work performance.

Try to imagine an information economy starved of information. The concept clearly has potential problems.

"Article 17 will give EU residents an unprecedented inalienable right to control and delete facts that were once voluntarily communicated by the subject," explained Jane Yakowitz, visiting assistant professor of Brooklyn Law School, in an online post.

EU justice commissioner Viviane Reding described that right thus in a statement last week: "If an individual no longer wants his personal data to be processed or stored by a data controller, and if there is no legitimate reason for keeping it, the data should be removed from their system."

Article 17 has some limits. The proposed rules recognize that people can't have the right to erase history, hinder free expression, harm public health, or impede scientific research with their desire to delete their data.

But Yakowitz argues the limits are undermined by restrictive wording and draconian fines.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Bprince
50%
50%
Bprince,
User Rank: Ninja
1/31/2012 | 5:36:07 PM
re: EU Data Rules Worse Than SOPA?
There is a chance this proposal will be altered somewhat as it goes through the legislative process. More comparing the rules to SOPA from Time:
http://techland.time.com/2012/...
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Tony A
50%
50%
Tony A,
User Rank: Apprentice
1/31/2012 | 9:01:50 PM
re: EU Data Rules Worse Than SOPA?
Nowhere in this article do I see any hint of an argument for why the "right to be forgotten" would conflict with freedom of expression. It conflicts with the self-interest of ISP's, search and social networking sites to utilize your content for their profit. These companies have lots of ways of making money without mining my posts for monetary gain. They also benefit from the general carelessness with which people offer and leave personal information online, which wouldn't change even if the EC law is enacted. They benefit from people's laziness in utilizing opt-out privileges. They benefit from court rulings that give them access to data that does no more than briefly pass through a server on the way to another desitnation. They have no inalienable right to any of this. If they want to provide a service and reap some ancillary benefit from it, fine, but their ability to do this does not give then any valid claim to the use of a post. Online content posted by users of a service should be protected by international copyright like every other original creation. That means that basically the only uses of it that can be made without my explicit permission are under the "fair use" convention, e.g., to quote it or use it for educational purposes. The right to profit from it does not exist. Go, EU!
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5700
Published: 2014-09-22
Multiple cross-site scripting (XSS) vulnerabilities in Baby Gekko before 1.2.2f allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to admin/index.php or the (2) username or (3) password parameter in blocks/loginbox/loginbox.template.php to index.php. NOTE: some o...

CVE-2014-0484
Published: 2014-09-22
The Debian acpi-support package before 0.140-5+deb7u3 allows local users to gain privileges via vectors related to the "user's environment."

CVE-2014-2942
Published: 2014-09-22
Cobham Aviator 700D and 700E satellite terminals use an improper algorithm for PIN codes, which makes it easier for attackers to obtain a privileged terminal session by calculating the superuser code, and then leveraging physical access or terminal access to enter this code.

CVE-2014-3595
Published: 2014-09-22
Cross-site scripting (XSS) vulnerability in spacewalk-java 1.2.39, 1.7.54, and 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.4 through 5.6 allows remote attackers to inject arbitrary web script or HTML via a crafted request that is not properly handled when logging.

CVE-2014-3635
Published: 2014-09-22
Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows remote attackers to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one m...

Best of the Web
Dark Reading Radio