Welcome address at the 3rd annual FRA symposium on data protection

Welcome speech at the 3rd annual FRA Symposium : "European data protection reform: new fundamental rights guarantees".

Ladies and gentlemen,

Let me welcome you wholeheartedly to Vienna to our 3rd Annual FRA Symposium.

Each year, the Symposium gathers experts to focus on a particular fundamental rights issue.

The first Symposium, two years ago, looked at strengthening the fundamental rights architecture in the EU. We presented, among others, our findings on the role of national data protection authorities in the EU. We found that to ensure that national data protection authorities are independent and efficient, they need both an adequate mandate as well as sufficient human and financial resources.

Last year, the Symposium dealt with fundamental rights indicators, as indicators provide a toolkit for showing whether fundamental rights are being rolled out in practice.

And this year we focus specifically on data protection. We will examine the fundamental rights aspects of the new data protection package. The data protection package was presented by the European Commission in January 2012. The widereaching

reform comprises two legislative proposals:

•A Regulation protecting the processing and free flow of individuals’ personal data; and

•A Directive protecting the processing of personal data by competent authorities for preventing, investigating, detecting, prosecuting or penalising criminal offences.

Ladies and gentlemen,

The 16th century poet, John Donne, once wrote: No man is an island entire of itself; every man is a piece of the continent, a part of the main.

Today we could say: No fundamental right is an island!

Data protection is not a right that exists in isolation. The Charter of Fundamental Rights, as a modern response to fundamental rights in the 21st century, includes a specific article on the protection of personal data. This feature sets the Charter apart from other key human rights documents which, for the most part, treat the protection of personal data as an implicit extension of the right to privacy. But this article has to be read alongside the other articles set out in the Charter – such as non-discrimination, freedom of expression and the rights of the child. Together, they all make up the larger body of rights that everyone in the EU is entitled to. Which is why when one looks at reforming one right, a specialist rights body like the Fundamental Rights Agency can help by bringing in the collective knowledge and experience that it has gathered together with its stakeholders on all other rights. Which is why we are all gathered here today.

So - in what way can the Symposium discussion contribute to the on-going overall debate on the data protection package?

The new legislative proposals on data protection are comprehensive and cover a wide range of issues. Today we will focus on three important points that can have a bearing on our fundamental rights and could help feed into the fine tuning of the new data protection rules:

• The right to be forgotten and the right of portability;

• The independence and powers of national data protection supervisory authorities; and

• The issue of automated processing of personal data to evaluate an aspect of a person’s characteristics, in other words, profiling.

These topics were chosen carefully, as we hope the outcome may feed into interinstitutional discussion on the data protection package. And it is true that a lot has changed in this area - which indeed merits new attention from the legislators.

a) Technological developments, undoubtedly, bring huge progress. However, with progress there are often unexpected side effects. Take the right to be forgotten: the initial excitement of signing up to social networks and speaking our mind freely and sharing our photos openly on the net, has given way to trepidation. We all have heard stories of people who faced problems in their jobs because of something they may have posted on some social network. Sharing our personal data may have huge repercussions on people’s personal lives. So, how can they be protected?

b) And what about the independence and powers of national data protection authorities. I already mentioned our report from two years ago. Financial autonomy and specialized professional staff are not only essential for ensuring the effective protection of personal data rights, but also essential for true independence from the will of government.

It is reassuring to note that the proposal for a new data protection regulation contains, for the first time, explicit guarantees in this respect. This provision should ensure that each Member State provides data protection authorities with the human, technical and financial resources, as well as the premises and infrastructure they need for the effective performance of their duties and powers. Undoubtedly today’s discussions will help assess jointly where the new legislative package sufficiently guarantees the independence and mandate of these authorities.

c) And finally, profiling: When I go to the local supermarket, I get vouchers for products that I have bought previously – offline, as also happens online, my consumer profile has been created. On the one hand a more targeted service is helpful, but on the other I wonder who has developed my profile, how has this been done, and who knows what about me? Which brings me back to the first point – the right to be forgotten.

Ladies and gentlemen,

By making the Charter of Fundamental Rights a legally-binding document, the Union and its Member States have committed themselves to safeguarding and promoting all fundamental rights. The proposed data protection rules can and will impact on fundamental rights, generally. To what extent and how is what we are here to discuss.

We need an open dialogue on which rights are affected, and to what extent they conflict with each other. This will allow us to check which legislative action is required to ensure full respect for all fundamental rights, including the protection of personal data.

So let us here build the bridges that will connect the islands in order to protect and respect both our personal data and also all our other rights. In this way we may be contributing to a new era of data protection in Europe.

I wish you very fruitful discussions and thank you for your attention.