ARTICLE 29 DATA PROTECTION WORKING PARTY: Opinion 2/2010 on online behavioural advertising

Behavioural advertising entails the tracking of users when they surf the Internet and the  building of profiles over time, which are later used to provide them with advertising matching  their interests. While the Article 29 Working Party does not question the economic benefits  that behavioural advertising may bring for stakeholders, it firmly believes that such practice  must not be carried out at the expense of individuals' rights to privacy and data protection.  The EU data protection regulatory framework  setting forth specific safeguards must be  respected. To facilitate and encourage compliance, the present Opinion clarifies the legal  framework applicable to those engaged in behavioural advertising.   In particular, the Opinion notes that advertising network providers are bound by Article 5(3)  of the ePrivacy Directive pursuant to which  placing cookies or similar devices on users'  terminal equipment or obtaining information through such devices is only allowed with the  informed consent of the users. The Opinion notes that settings of currently available browsers  and opt-out mechanisms only deliver consent in very limited circumstances. The Opinion
asks advertising network providers to create prior opt-in mechanisms requiring an affirmative  action by the data subjects indicating their willingness to receive cookies or similar devices  and the subsequent monitoring of their surfing behaviour for the purposes of serving tailored  advertising. The Opinion considers that users' single acceptance to receive a cookie may also  entail their acceptance for the subsequent readings of the cookie, and hence for the  monitoring of their internet browsing. Thus, to meet the requirements of Article 5(3) it would  not be necessary to request consent for each reading of the cookie. However, to keep data  subjects aware of the monitoring, ad network providers should: i) limit in time the scope of  the consent; ii) offer the possibility to revoke it easily and iii), create visible tools to be  displayed where the monitoring takes place. This approach would address the problem of  burdening users with numerous notices while ensuring that the sending of cookies and the  subsequent monitoring of Internet surfing behaviour for the  purposes of serving tailored  advertising only takes place with data subjects' informed consent.   Because behavioural advertising is based on the use of identifiers that enable the creation of  very detailed user profiles which, in most  cases, will be deemed  personal data, Directive  95/46/EC is also applicable. The Opinion comments on how advertising network providers  should comply with the obligations that arise from this Directive, notably, with respect to  rights of access, rectification, erasure, retention, etc. Taking into account that publishers may  share certain responsibility for the data processing that takes place in the context of
behavioural advertising, the Opinion calls upon publishers to share with ad network providers  the responsibility for providing information to individuals and encourages creativity and  innovation in this area. Given  the nature of the practice of behavioural advertising,  transparency requirements are a key condition for  individuals to be able to consent to the  collection and processing of their personal data and exercise effective choice. The Opinion  sets out the information obligations of advertising network providers/publishers vis-à-vis data  subjects, referring in particular to the ePrivacy Directive, which requires that users be  provided with "clear and comprehensive information".  The Opinion analyses and clarifies the obligations set forth by the applicable legal  framework. However, it does not prescribe how, from a technology point of view, such
obligations must be complied with.  Instead, in different areas, the Opinion invites industry to  undertake a dialogue with the  Article 29 Working Party with the view to put forward  technical and other means to comply with the framework as described in the Opinion as soon  as possible. Towards this end, the Article 29 Working Party  will contact stakeholders to  request their input. Entities that are not explicitly consulted are welcomed to send their  contributions to the Secretariat of the Article 29 Working Party.

If you want to know more please click here

My personal point of view on whether the HR departments Google your name before they hiring their employees..

 Is the  candidate willing to give his/her consent on HR departments to conduct certain searches on Google? If that's the case (eventhough I am not affiliated with any HR departments) I believe that there should be a certain procedure, cause I don't think there is so far.

So far, it is an ethical issue as it cannot be a legal one.
So I assume that it's more an ethical issue, at least for the time being.

Facebook is designed to limit the availability of your profile to your friends and only those in your other networks via the privacy settings. If you use the privacy features and believe that some employers got into your information unauthorized, then you might have a case.

"However, use of Facebook by potential employers is not addressed the Terms of Use for Facebook. The Terms of Use does say that its use is restricted to personal and non-commercial uses. ”Non-commercial” use means posting information for personal gain, like ads, which is prohibited. However, it does not mean an employer cannot access your information for commercial purposes, like research to make a hiring decision." (Potter 2008). It is difficult for the candidate to prove that kind of case, namely that he/she was rejected because of her FB account (maybe it could be proven through the a Freedom subject access request in an public organisation where the candidate could ask for the email correspondence, in case she/he feels that he/she was rejected by virtue of his online activity).
However, in the UK, could happen the same like Germany:http://dealbook.nytimes.com/2010/08/26/germany-plans-limits-on-facebook-use-in-hiring/



What happens in terms of authenticity?? Is it the right candidate the person that the HR has spotted or is it a different one? Is there synonymity? What the candidate expresses on his Twitter/FB/LinkedIn account is an exaggeration, figure of speech?
However the previous point of view (authenticity), can be contradicted by the fact that then if the HR is able to find the right candidate by Googling his/her name, then the HR will identify his/her ethnic background. In this case, is the HR going to select this person based on the candidate's ethic background or is the HR going to be effected by his/her photos and comments?
At the same time the HR office by Googling candidates  may find information that are related to the sensitive personal data of a candidate (e.g related to his health or sexual orientation or religious beliefs). For example the candidate on the application form, is not willing to state his religious beliefs, that the HR already know his/her religious beliefs.

There are so many variables, which some of them contradict the others.
I

Based on the above, I gave some examples on some grey areas, that I consider them as grey.

For the selection process (and if Googling help the HR to select the right staff), at least for the time being, I don't think it could assist on the selection process.
However, if the HR departments set some (ethical) rules within the company and they explicitly state on the company's website that e.g. the HR reserves the right to conduct Google search (maybe for its strongest candidates, the ones that were shortlisted), then in that case I don't think it should be a problem.". In that case I believe that it would help with the selection process.

Conducting a thorough search for all candidates I assume it would be time consuming. BuT for the ones that were short-listed, I believe that it is quite reasonable.

Also, it's our responsibility to be able to control our own accounts, in terms of privacy.

For any questions/comments please, by all means you can comment. 

Why the EU Privacy Directive is not a real threat to the internet industry

The new EU e-Privacy Directive that comes into effect in the UK on May 25 has caused a major stir in the local internet community, but its real impact will depend on enforcement and ‘cost’ to end users.

Could common sense prevail? Perhaps, but in the end practicality will...

Read more for the  EU e-Privacy Directive 

Source: http://econsultancy.com/uk/blog

Location Based Services: European Data Protection Rules for Mobile Commerce

Wireless systems and unique identification of communication devices, combined with location data, enable service providers to deliver services based on location information. Information services that use the localization of the user via mobile network cells or satellites, in order to offer the user services that are tailored to its precise geographic position (so-called ‘‘Location Based Services’’ (LBS)), are among the most attractive services of mobile commerce. Examples of such services include; navigation services (tourist offers, management of car fleets or sales representatives, etc.); computer games and other games that make use of the possibility to locate the player (scavenger hunt, quiz, etc.); information services (weather, leisure time, restaurants, shopping, etc.); as well as advertisements (vouchers, etc.).
Read more for the Location-based services

Source: http://www.hunton.com/files  JORG HLADJ

Data Protection and Small and Medium Enterprises - REPORT

1 There is a high level of awareness of data protection and the Data Protection Act. 


2 There is broad acceptance of the values and principles of data protection, although opinions  appear divided as to the benefits of compliance. 


3 Awareness and acceptance of principles in broad terms does not necessarily translate into 
specific knowledge of registration/notification. 


4 The compliance or ‘red tape’ burden associated with government regulation does not appear to  be a major issue for the Data Protection Act for most of the business, although there is a small  ‘vocal minority’ who consider this an issue. 


5 Two key terms registered most strongly with the businesses  (1) Security of Data and Information, and (2) Confidentiality.  Privacy also figured as a significant term, but not to the  same extent. 


6 Effective practice in data protection was closely associated with wider information management  and data control within the business – those enterprises that deployed information for business benefit tended to be actively supportive of data protection principles and found it easy to comply  with the Act. 


7 Individual and shared attitudes towards data protection and information are key influences on  business approaches to this issue, and so constitute a primary influence on compliance and  engagement with the Act and the ICO. 


8 Different approaches to data protection and information can be identified, and used to identify  distinctive segments – each with different requirements and approaches. 


9 There was some indication that respondents were considering effective practice in information  and data management and handling, with data protection being seen as a ‘sub-set’ of these  considerations.  Good practice in data protection, in other words, appears to be part of and to  stem from wider approaches to information. 


10 Although the Act itself had a high profile, the ICO was less well known and some businesses  thought that it would be useful for the ICO to engage more with SMEs
Full Report


Source: http://www.ico.gov.uk

Safe Harbor: Why EU data needs 'protecting' from US law

Why were the Safe Harbor principles created in the first place? To maintain trade between Europe and the United States, with Europe fully aware of the lax attempts at data privacy performed on the part of the U.S.’s biggest companies.

Why Europe needed Safe Harbor principles

The vast majority of people using services on the web — be it web-based email like Hotmail or Yahoo!, social networks like Facebook and Twitter, or anything as minute as a website requiring registration– tend not to think about where their personal data like photos and email is stored.

On the whole, these services are designed to save us time and energy, and we have come to want the offerings of these services on-demand, without thinking too much about privacy. We expect our respective governments, wherever we are in the world, to protect us to a level where we can act and communicate freely.

However, an inequality in legal protection between the United States and the European Union could have massive consequences for users of ‘the cloud’.

Data protection legislation differs greatly between the European Union and the United States. With a vast number of organisations branching out to worldwide offices during the dot-com boom, it was clear to legislators that data transfer and protection laws needed a global overhaul. A particular area of focus for data legislation was the European Union, with dozens of countries sharing elements of the same law.

If you want to read more, click here

Source: http://www.zdnet.com/

EU privacy report: Search engines should delete data

A European Union privacy panel wants Internet search engine providers like Google and Yahoo to delete data taken from users after six months, even when they operate abroad.

If you want to read more, please click here

Source: http://abcnews.go.com/Technology/story?id=4627800&page=1