Data protection authorities and information technology

TL;DR: The findings of a recent survey of EU DPAs are reported that explore the problems they have in comprehending new technologies and how they are dealing with them.

About: This article is published in Computer Law & Security Review.The article was published on 2017-08-01 and is currently open access. It has received 23 citations till now. The article focuses on the topics: General Data Protection Regulation & National data protection authority.

Summary

1. Introduction

• In the field of information privacy, the overwhelming focus of scholarship for several decades has been on the legal and – increasingly – the technological dimensions of data protection; far less attention has been devoted to understanding the work of regulatory organisations, of which data protection authorities (DPAs) are the most prominent.
• Thus the styles and strategies of DPAs in their regulatory roles are not uniform across the landscape of European or global data protection.

2. The survey and its methodology

• This article attempts to cast light on this subject by reporting the findings of an empirical survey of all EU DPAs that was conducted in late 2015 and early 2016.
• The authors are grateful participants – all of whom had significant expertise in this topic – were faced with the results of the survey analysis: their on-site evaluation and comments added important aspects to the findings of the survey.
• This survey aimed to find out the extent to which DPAs were abreast of changes in ICTs with which personal data are processed and which powerfully shape the terrain on which DPAs’ regulatory and supervisory activities take place.
• For their participation in the panel, and for their agreement to allow us to use some of the remarks they made in the CPDP panel session.

2.1. DPAs’ expertise in information technologies

• The survey included a question about how the data protection authorities evaluate the expertise of DPAs in general in the area of information and communication technologies.
• When asking the respondents to evaluate the level of expertise in ICT in their own organisation, the figures were somewhat higher: DPAs tended to evaluate their own expertise higher than that of the community of DPAs (Fig. 1).
• The data protection authorities of the federal states of Germany, or those of the cantons of Switzerland.
• The biggest organisation had 379 employees, while the smallest one had a staff of a single person.
• Those who were not satisfied with the existing level of ICT expertise among the members of their non-technical staff were asked about the causes of the shortfall.

2.2. The necessary ICT expertise in investigations

• The survey included a question about the percentage of the respondent organisation’s investigations (responding to data subjects’ complaints or initiated by the DPA itself) that involve general ICTrelated aspects (such as the use of computerised databases or the Internet).
• In the next question the authors asked the respondents about the percentage of investigations that require specific ICT expertise.
• The vertical lines connecting the round and the triangle dots show the distance between the two, that is, the difference between the two types of investigations belonging to the same DPA.
• A panellist added that data controllers can mislead DPAs in such matters whenever they want but they do this only infrequently, because they are afraid of the risks.

2.3. DPAs’ strategies in ICT-related decision-making

• Experience shows that DPAs, partly owing to the administrative and legal traditions of their respective countries, and partly to the traditions of the working methods they had developed over the years, lay different emphasis on the various tasks and roles the authors referred to in the Introduction of this article.
• This is also reflected in the way DPAs take part in ICT-related decision-making, including legislation, regulation, or giving opinions on certain data processing operations.
• The survey offered two options to the respondents: whether they prefer (a) participating proactively in strategic decision-making in privacy-related ICT matters, or (b) waiting until the real implications will be clear, and responding accordingly.
• Almost all DPAs preferred the proactive strategy, and only a few organisations preferred the reactive approach (Fig. 7).
• The few DPAs that preferred reactive actions mentioned their limited resources, or the fact that their organization is not involved in the legislative process, however, one DPA clearly stated that the proper strategy is to act only when the challenge is clear.

2.4. DPAs’ preferred ways to keep up with new developments

• The authors did ask a question about the methods DPAs prefer in acquiring this knowledge, with special regard to understanding FETs.15.
• As can be seen in Fig. 8, respondents indicated a range of options, attending conferences and learning sessions being the most popular.
• The second most popular method was ‘bringing in expertise from outside when necessary’: more than twenty DPAs preferred this option.
• This seems to be somewhat contradictory to the opinions expressed in the issue of developing expertise in-house v. importing expertise from external sources, when only five responding authorities were in favour of the latter alternative.

2.5. The most important technologies: everything?

• The authors asked DPAs to say which technologies or applications they thought will have the most significant impact on privacy in general, and on DPAs’ activities and responsibilities in particular.
• The authors expected the frequent mentioning of well publicised technologies/applications such as big data analysis or the internet of things, along with a few country-specific ones.
• 18 Respondents could mention any number of technologies they found important.
• There were 152 mentions altogether; this means that one technology was mentioned only 2.2 times on average.

3. Conclusion

• The survey findings and the public discussion shed light on the fact that European data protection authorities regard the importance of this area differently, due to the different nature of their investigations, their different approaches to influencing developments in data processing technologies, and the differences in their available resources.
• Another panellist replied to the moderator’s question and noted the absence of a benchmark: it is difficult to evaluate even one’s own expertise without such a benchmark, and makes the comparison between DPAs debatable.
• 23 20 A member of the audience, during the discussion of the survey findings, publicly offered to help in clarifying the impact of new and emerging technologies, if invited by a DPA.
• Therefore developing such expertise, and keeping up with new developments, is a core necessity for DPAs.

Figures

Fig. 7. Proactive or responding strategies

Fig. 6. Developing own ICT expertise or importing from external sources

Fig. 1. DPAs’ expertise in information and communication technologies

Fig. 5. DPA investigations involving ICT aspects in general and those requiring specific ICT expertise

Fig. 9. Relevant privacy-related technologies

Fig. 3. Level of ICT expertise of non-technical staff at DPAs

Fig. 2. ICT expertise of non-technical staff at DPAs

Fig. 8. Keeping up with new developments in ICT

Fig. 4. Not sufficient expertise: Causes of the shortfall

Frequently asked questions

Q1. What are the contributions in this paper?

The ability of data protection authorities ( DPAs ) to gain and deploy sufficient knowledge of new technological developments in their regulation of personal-information practices is an important consideration now and for the future. This article reports the findings of a recent survey of EU DPAs that explore the problems they have in comprehending new technologies and how they are dealing with them. 

Q2. What is the prominent case-in-point in the US?

Countries are frequently criticised for only passing laws to protect privacy without also creating implementation machinery that gives the law force through the institutional machinery by means of which compliance, good practice, and other requisites can be encouraged or required; the US is the most prominent case-in-point. 

Q3. What is the popular method of acquiring knowledge?

Formal training was also among the popular options, and the respondents mentioned a range of other methods as well; for example:• individual self-development, such as reading professional literature or taking courses; • learning while doing, i.e., acquiring the necessary knowledge on the job; • organising in-house informal training sessions; • asking or accepting assistance from the business or the academic community; • exchange of experience and expertise with other DPAs; • participation in research projects at the intersection of data protection and technology. 

Q4. What was the common opinion among DPAs?

The survey found that the predominant opinion among DPAs was in favour of developing the necessary information technology expertise in the framework of their organisations and only a few DPAs thought that relying on the expertise of external ICT professionals was a better solution (Fig. 6). 

Q5. How many DPAs evaluated the proportion of their staff as satisfactory?

In the 11-25% category about the same number of organisations evaluated this proportion as satisfactory and unsatisfactory, evenly distributed on the scale of the DPAs’ size. 

Q6. What was the percentage of DPAs that preferred in-house development of expertise?

Among those that preferred in-house developing of expertise and explained their choice, the following reasons deserve noting:• in the field of privacy and data protection, IT professionals need special knowledge, not only in legal terms but also in the technologies of processing personal data, and such a knowledge can be developed to the required level within DPAs and more easily in the course of practical audits of data controllers;• ICT expertise has to be continuously available in-house, not only when a specific case makes it necessary; • DPAs have to be proactive, conducting preliminary audits and evaluating privacy and data protection impact assessments of new data controlling operations, and since such operations are based almost entirely on new data processing technologies, these investigations also need the participation of ICT experts (one organisation noted that independence and impartiality can only be ensured if the experts represent the DPA itself;(1) frequently, (2) sometimes, (3) almost never, the majority of the audience voted for option 2. 

Q7. What was the purpose of the survey?

The survey was organised to coincide with a public panel discussion on DPAs’ understanding of ICT that was chaired and moderated by the authors in the Computers, Privacy and Data Protection (CPDP) conference4 held in Brussels in January 2016.5 

Q8. Why did two of the panellists think they were better placed than the others?

In the opinion of two of the panellists, this was due to a psychological characteristics of the institutions: they see themselves in a better position than that of ‘the others’.