Applic­a­ble as of May 25, 2018, a new Euro­pean reg­u­la­tion (the Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR) stip­u­lates how per­son­al data can (or can­not) be processed. It is a text that pro­pos­es sev­er­al inter­est­ing pro­vi­sions designed to pro­tect our pri­vate sphere on the Inter­net. Lionel Mau­rel, a lawyer by train­ing, pub­lic librar­i­an at the Uni­ver­si­ty of Paris Lumières and a mem­ber of the asso­ci­a­tion ‘Quad­ra­ture du Net’ [squar­ing the net], gave a lec­ture at UTC on this sub­ject. He deci­phers the main chal­lenges of this new piece of Euro­pean legislation. 

How does one define ‘per­son­al data’? Per­son­al data refers to all and any infor­ma­tion that enables an iden­ti­fi­ca­tion of an indi­vid­ual: which can be one’s name, opin­ions, social secu­ri­ty matric­u­la­tion, bank account N°, one’s PC IP address, eye-iris prints, fin­ger prints or a pho­to … as of 1978, France pio­neered infor­ma­tion pro­tec­tion with its law called “EDP and free­dom Act”. As pub­lic ser­vices became more and more com­put­er­ized, the aim of this law was to pre­vent per­son­al data files being drawn up by the State author­i­ties. Since the 1990s, cer­tain prin­ci­ples under­pin­ning this French law have been incor­po­rate in Euro­pean direc­tives. The GDPR uni­fies and rein­forces these provisions. 

To what extent does the GDPR reg­u­la­tion sig­nal an impor­tant step forward?

Before GDPR, it was fair­ly easy for non-Euro­pean com­pa­nies to by-pass the then exist­ing leg­is­la­tion. From now on, the pro­cess­ing of per­son­al data apper­tain­ing to Euro­pean cit­i­zens, no mat­ter the agent doing so, must com­ply with this reg­u­la­tion. It con­sti­tutes a “first ever” on a glob­al scale. It took over two years of debate in the Euro­pean Par­lia­ment to achieve this result. The Google, Face­book… lob­by put up an intense attempt to block GDPR leg­is­la­tion but the civil­ian soci­ety prevailed. 

What are the main areas of progress you see, in terms of user protection?

This new legal frame­work con­tains some very impor­tant pro­vi­sions such as the need to secure free and informed con­sent from those con­cerned. This means that for the col­lect­ing, analy­sis and exchange of per­son­al data, the com­pa­nies (or insti­tu­tions) who do so must first­ly (and in most cas­es) obtain express con­sent. For exam­ple, sim­ple con­sul­ta­tion of an Inter­net page can no longer be seen a tac­it con­sent to receiv­ing cook­ies. It is hence­forth ille­gal to make use of per­son­al data a con­di­tion to access­ing a ser­vice. It must remain pos­si­ble to para­me­ter var­i­ous options and lev­els of con­fi­den­tial­i­ty. The default posi­tion here must cor­re­spond to the least acces­si­ble con­fig­u­ra­tion in regard to one’s per­son­al data. Func­tions such as face recog­ni­tion pro­posed by Face­book when a pro­file is opened can­not be acti­vat­ed automatically. 

What part of this domain should receive spe­cial atten­tion and in-depth inves­ti­ga­tion? The GDPR demands that that must be used in a clear­ly defined man­ner, jus­ti­fied by ser­vice needs and trans­par­ent as seen from the user’s view. Stor­ing data with no spe­cif­ic final­i­ty will not be allowed. How­ev­er, there may be excep­tions such as “legit­i­mate inter­ests”. This is a mea­sure that relates to the con­nec­tion data need­ed to ensure secu­ri­ty with identifiers/passwords. But nonethe­less, one must remain vig­i­lant. There is a fuzzi­ness in the con­cept such that the door is ajar for abuse by mar­ket agents. Agents whose eco­nom­ic busi­ness mod­el relies on adver­tis­ing data files could eas­i­ly raise the issue for sur­vival of their services. 

What sanc­tions can be tak­en if non­com­pli­ance is noted? To date, the sanc­tions the CNIL could hand down were lim­it­ed. As of now, with GDPR, the lim­it is up to 4% of an offender’s annu­al turnover, which is no sym­bol­ic val­ue, espe­cial­ly for the ‘giants of the Inter­net”. Before this, indi­vid­ual legal action had to be tak­en against the major com­pa­nies. Now, joint legal or ‘class-action’ as it is called is per­mis­si­ble. The asso­ci­a­tion ‘Quad­ra­ture du net’ has launched sev­er­al legal com­plaints against the GAFAMI (Google, Apple, Face­book, Ama­zon, Microsoft, IBM) and sev­er­al thou­sand per­sons have sub­scribed to these actions in court.   Cf. www.laquadrature.net/fr www.uplum.fr