1. Navigating the Privacy Sea
Christian M. Runte, CMS Hasche Sigle
IFCLA – Helsinki, 10 June 2010

2. 1. The Privacy Sea
2. How to Navigate it
2 Christian Runte | Navigating the Privacy Sea | IFCLA – Helsinki, 10 June 2010

3. 3 Christian Runte | Navigating the Privacy Sea | IFCLA – Helsinki, 10 June 2010

4. 4 Christian Runte | Navigating the Privacy Sea | IFCLA – Helsinki, 10 June 2010

5. Why the Sea Got Rough
Advanced technology (internet, increased storage capability), and
increased relevance of data processing
Online transactions rapidly replacing "anonymous" real transactions;
online transactions require identification and thus personal data
Changes in legislation (data breach notification etc.)
Aftermath of 9/11, online surveillance
Media coverage of data breaches and other privacy issues in the public
sector (UK CD-ROMs, German tax data) and in the private sector
(Facebook, Google, in Germany: Lidl, Deutsche Telekom etc.)
5 Christian Runte | Navigating the Privacy Sea | IFCLA – Helsinki, 10 June 2010

6. How Fragmented is Privacy Law?
EU level
One general directive (95/46/EC) but numerous other regulations,
directives and decisions which also contain data protection
provisions
Some better known: 2002/58/EC etc.
Some more hidden: Regulation 80/2009 etc.
Consultation process for new general directive 95/46/EC
"Harmonized diversity"
Implementation in member states differs, sometimes significantly
Differences in processes, formalities and bureaucracy
No single authority for the EU or even within some member states
6 Christian Runte | Navigating the Privacy Sea | IFCLA – Helsinki, 10 June 2010

7. Regulatory Authorities Dealing with Data
Protection Aspects: Germany
Federal Level: 1 (+1)
Länder Level: 25
1
Further Authorities for Churches, 1
Public Broadcasting, Public 1
1
Healthcare etc. 3 1
1 2
Art. 28 [1] Directive 95/46/EC: 1 2 3
1
"authorities shall act with complete
independence in exercising the 1
2 2
functions…"
2
ECJ, 9 March 2010: Germany system
in violation of Art. 28 [1]
7 Christian Runte | Navigating the Privacy Sea | IFCLA – Helsinki, 10 June 2010

8. Everything Converging in the Cloud?
"Everything is content"
Convergence of technology and media delivery
Convergence of substantial law?
Possible but likely to be very slow
Overhaul of General Directive 95/46 (e.g. data breach)
Geographical convergence?
Which jurisdiction applies?
More jurisdictions will apply
Technical innovations (in particular cloud computing) will make it
more complicated to be compliant in all relevant jurisdictions
8 Christian Runte | Navigating the Privacy Sea | IFCLA – Helsinki, 10 June 2010

9. Navigating it
9 Christian Runte | Navigating the Privacy Sea | IFCLA – Helsinki, 10 June 2010

10. Challenges
More cases will require advice for more than one jurisdiction
Knowledge of the local law
Contact to relevant authorities
The challenge is the number of countries and authorities involved and the
number of local advisor you may need
Cost
Consistent advice
Requires management of
the client
and local advisors
10 Christian Runte | Navigating the Privacy Sea | IFCLA – Helsinki, 10 June 2010

11. A Possible Approach
Prepare your (local) memo first
Managing multiple jurisdictions
Do some local reconnaissance
• General ressources
• Websites
• Online Materials
Prepare questionnaire
• Clearly defined questions
• Provide your local answers as well
Budget, no quote
Direct contact between client and local counsel
11 Christian Runte | Navigating the Privacy Sea | IFCLA – Helsinki, 10 June 2010

12. Après Nous le Déluge
Public perception of data protection and privacy will not vanish, media
will drive the process
Overhaul of Directive 95/46, consultation process
More convergence?
It's not a breach, it's a service
12 Christian Runte | Navigating the Privacy Sea | IFCLA – Helsinki, 10 June 2010

13. Last page
13 Data Breach Laws | ICAF – Berlin, 25 February 2010