By John Kropf

The Spanish Data Protection Authority on June 11 held a second meeting to discuss a proposed draft international privacy standard. The data protection authorities involved seek to complete the document for adoption at the meeting of the International Conference of Data Protection and Privacy Commissioners (ICDPPC) in Madrid this November.
Of the 14 national-level authorities in attendance, most represented EU data protection authorities (Spain, Czech Republic, France, Germany, Ireland, Italy, Portugal, the Netherlands, the UK, and several regional authorities). The European Data Protection Supervisor (EDPS) participated, as did representatives from New Zealand, Switzerland, and Burkina Faso. The United States Federal Trade Commission and Department of Homeland Security were invited to participate as observers.
The group’s biggest challenge is the nature of the document. ICDPPC had called earlier for a UN convention, and the draft documents so far have been written at least in part as “hard law.” Keeping in mind the time needed to fully develop a convention and other hard law, the authorities are considering whether to revise the document into a shorter paper setting forth more general principles, to be accompanied by an explanatory memo.

The remainder of the meeting focused on a series of substantive issues:

   1. Definitions: This included analysis of the challenges associated with reconciling the EU concepts of controller and processor with non-EU concepts.
   2. Scope of application: particularly important here was discussion of whether the standards should apply to the public sector and law enforcement, and the different issues raised in this area.
   3. Sensitive data: The participants questioned whether types of sensitive data should be listed or whether the focus should be on areas where there is a risk of harm. Some reference was made to the APEC harm principle.
   4. International data transfers: The participants' assessments of the adequacy requirement were surprisingly negative. Participants suggested that other approaches should be considered, such as accountability.
   5. The group discussed the nature of supervisory authorities with emphasis on the meaning of “independence.” Varying degrees of flexibility for different traditions existed.
   6. Accountability principle: The discussion about focusing on accountability, a feature of the APEC privacy framework, was overall relatively positive.
   7. Applicable law: Several authorities emphasized the difficulties in addressing this subject.

A new draft of the proposal is expected to be presented at the conference in November.  

John Kropf is the deputy chief privacy officer and senior adviser for the U.S. Department of Homeland Security. The views expressed here are his own and not those of the U.S. Government.