EDRI and a coalition of civil liberty groups has organised a pre-event at the international conference of data protection commissioners on 12 September in Montreux. The aim was to strengthen cooperation between NGOs and official data protection authorities (DPAs). The meeting was well-attended by NGOs, privacy officials and industry representatives and led to promising discussions on how to improve collaboration in the future.
The panel on data retention noticed the interesting development of an emerging "rainbow coalition" between civil liberties groups, DPAs, Internet and telecommunication providers, and the European Parliament. Hielke Hijmans from the Office of the European Data Protection Supervisor (EDPS) presented the concerns of the EDPS. He made it clear that "terrorism is not out of this world when you retain data", and while protecting our societies, "we must not forget our basic values like privacy, as enshrined in article 8 of the European Convention on Human Rights". Because data retention is already applied in some EU member states, the EDPS is currently working under the assumption that an EU directive can not be stopped completely. Therefore, they focus on safeguards and limiting types of data and retention periods. Cédric Laurant from co-organiser EPIC pointed out that data preservation regimes (only retaining data in specific investigations) "have not prevented law-enforcement agencies from doing their job". Even the heavily criticised Council of Europe's Cybercrime Convention only contains data preservation. Following the EU discussions on data retention, though, a number of countries including Nigeria, Estonia, and Argentina have adopted data retention laws. Peter Swire from Ohio State University, the former Clinton Administration's Chief Counselor for Privacy, introduced a new way of framing the debate on data retention. It is not just a cost argument that helps to align with industry, but also a security risk. If all Internet traffic data are retained, Internet usage of police officers and security agencies will also be retained. Therefore, organised crime no longer has to bribe police officers in order to get inside information, but just needs to bribe ISP employees. This led to an interesting discussion on the security risks related to data retention. In the end, the most appealing argument was that not even the Bush administration agencies want data retention in their "war on terrorism".
The panel on biometrics started with the assumption by Gus Hosein from co-organiser Privacy International that these technologies are already here and can not be stopped anymore. Therefore, civil liberty groups have to come up with more realistic approaches. The Swiss Data Protection Commissioner Hanspeter Thür then presented his approach to biometrics. Different from the EU rush, Switzerland started a pilot project before deciding about the introduction of biometric passports. The DPA's biggest concern at the moment is the plan for a central national database for biometric passports. A plan for such a database for immigration control has already been stopped by the DPA. Barry Steinhardt from co-organiser ACLU pointed out the governments' "policy laundering" strategy, where they introduced biometric passports through the mostly unknown and in-transparent organisation ICAO and then at the national level referred to "international obligations". Stephanie Perrin from the Office of the Canadian Federal Data Protection Commissioner gave some examples of how to and how not to fight biometrics. The "it does not work" argument is tricky, because many of the technologies will work in a few years. More successful are early privacy impact assessments that are mandatory in Canada and a focus on standards organisations. The biggest problem and concern in biometrics is the creation of central databases, the participants agreed after also discussing security aspects in this field.
EDRI likes to thank EDRI-member Swiss Internet User Group (SIUG) and the Swiss coalition Communica-ch for taking care of the local arrangements and funding for this event.
Agenda of EDRI pre-event in Montreux (12.09.2005)
http://www.edri.org/panels
(Contribution by Ralf Bendrath, EDRI member Netzwerk Neue Medien and chair of the data retention panel)