e-Forum is holding on 8 February the first meeting of a working group on eGovernment and data protection. The working group will in particular consider the preservation of privacy rights under legislation that may be initiated by the Stockholm Programme, the European Union’s strategy for justice and home affairs. Registration for the working group meeting is closed, but a brief background on the Stockholm Programme and privacy is published below. To express interest in the future activities of the working group, contact e-Forum director Baudouin de Sonis.

In brief: privacy and the Stockholm Programme

The European Union’s heads of state and government at the end of 2009 formally adopted the Stockholm Programme. Running from 2010-2014, the Stockholm Programme will see the introduction of a number of measures relating to the EU’s internal security, its criminal and civil justice systems, and control of the EU’s external borders.

One political priority of the Stockholm Programme is ’Promoting citizenship and fundamental rights’. According to this priority, the exercise of personal "freedoms and citizens’ privacy must be preserved beyond national borders, especially by protecting personal data." The Stockholm Programme thus focuses on preservation of privacy rights when data is transferred between countries of the EU and to other countries, as is increasingly the case in a globalised world.

Specifically, the Stockholm Programme notes that EU citizens have privacy rights as set out in the EU’s Charter of Fundamental Rights. To ensure these rights, the EU must "foresee and regulate the circumstances in which interference by public authorities with the exercise of these rights is justified and also apply data protection principles in the private sphere." Among the issues the EU must consider when legislating are purpose limitation, proportionality, legitimacy of processing of data, limits on storage time, confidentiality, the individual’s right to information and to redress, and oversight of privacy by independent bodies.

Threats to privacy include:

• Technological threats: digital technologies vastly increase the scope for transfer of personal data, legally or illegally, throughout the world via numerous communication channels.
• Jurisdictional threats: within the EU, data protection regimes differ, while for data transferred outside the EU, ensuring privacy rights may be difficult or impossible.
• Transparency threats: data protection rules are complex and may not be understood by individuals or by data handlers, meaning that data is circulated without appropriate controls. With new technologies, it is increasingly unclear when data is collected, what data is collected, and what use it is put to.

To address these threats, the EU heads of state and government asked the European Commission to do the following:

• Assess the current data protection legal framework and propose improvements, where necessary;
• Propose specific rules on sharing of EU data for law enforcement purposes with the United States;
• Prepare a framework for data protection agreements with third states for law enforcement purposes;
• Work to improve compliance with data protection rules, especially through application of new technologies;
• Consider the introduction of an EU ’privacy aware’ certification scheme;
• Raise public awareness of privacy issues.

The heads of state and government asked the Commission to provide by June 2010 an Action Plan for implementing the Stockholm Programme, including its privacy elements.

Link: the Stockholm Programme as approved by the EU Council on 11 December 2009 (PDF file).