The digital age has led to the widespread use of computers, the internet and digital technologies. This is profoundly affecting social relations, business, private and public services which are more and more interconnected through smartphones and other connected devices. As a result vast amounts of data, often personal, are being amassed and processed in increasingly complex and opaque ways.
People around the world are reaping the benefits of these changing times: Search engines provide access to a wealth of information and knowledge; and social networking allows people around the world to communicate, express opinions and mobilise support for causes they feel passionate about. Technology and personal data processing are also indispensable tools for state authorities in their fight against crime and terrorism. Big data, a technology allowing the collection, storage and analysis of large amounts of information to identify patterns and predict behaviour, is also being harnessed in many ways to gain new insights and enhance productivity.
But despite this, substantial challenges exist. Regulators and lawmakers need to keep track of the pace and complexity of change. Mass surveillance and technologies allow globalised storage and processing of personal information and bulk access to data that may infringe the right to privacy and freedom of expression. Massive data sets can be further analysed to spot patterns yielding unprecedented insight into human behaviour and private life. Algorithms can be used for automated decision making. All this can be a worry if, for example, a person’s health or financial situation can be inferred by corporations using automated artificial intelligence to set health insurance premiums or to offer credit.
More than ever there is a growing need for the robust protection of personal data, a right safeguarded by both European Union and Council of Europe instruments. Further guarantees should be offered from May this year, when the EU’s reformed data protection rules will apply in the EU. They aim to empower users through greater control of their personal data. Users will have the ‘right to be forgotten’, a ‘right of data portability’, greater access to their data and the possibility to demand the end of use of their data. They can also seek compensation for rights violations.
The rules will apply to everything that holds or uses personal data in and out of Europe. They aim to ensure data protection by design and by default. This means safeguards should be inbuilt to products and services from the earliest stage of development, and privacy-friendly default settings should become the norm – for example on social networks or mobile apps.
In this fast moving area and with these new rules on the horizon, FRA will offer further support in the shape of its updated handbook on European data protection law. It will be released on 25 May to coincide with the application of the EU’s revised data protection rules. It will provide useful insights into European data protection law and how such law is being applied in practice – a must for all those working in this area or who may be affected by the changes the new rules will bring.