bepress Law Collection

Do not Dismiss ‘Adequacy’: European Data Privacy Standards are Entrenched

Graham Greenleaf — Wed, 08 Feb 2012 21:37:13 PST

The ‘adequacy’ mechanism in the EU data protection Directive, and perceptions of it, have been one (but only one) of the means by which the influence of European data privacy standards have been felt outside Europe. The EU’s ‘border control’ approach is to require member states to limit data exports unless ‘adequate protection’ can be demonstrated at the receiving end (EU Directive Articles 25, 26). There are now 81 jurisdictions in the world with data privacy laws, excluding those only covering the public sector (Greenleaf, 2011b), so there are 53 theoretical candidates for adequacy findings. However, the EU has only made adequacy decisions in relation to nine jurisdictions as a whole (Andorra, Argentina, Canada, Switzerland, Faroe Islands, Guernsey, Israel, Isle of Man, and Jersey), some of which are of relatively little economic or political significance.

‘Adequacy’ certainly has its critics, and many criticisms, theoretical and practical, have substance. But this article argues that we should not be too hasty, and outlines a number of reasons why ‘adequacy’ is now so entrenched in legal systems across the world that it will not be easy to remove. The list of countries considered adequate is expanding slowly: Uruguay and New Zealand will soon be added to the list. Despite the slow pace of the EU in making and publicising assessments, the desire to eventually obtain an ‘adequacy’ finding from the EU, or in a more amorphous form, to have one’s law regarded as of the highest international standard (that the EU Directive is considered by many to embody) has been a significant influence on the development of laws outside Europe. Consideration of the 29 African, Latin American, Asian, Australasian, and other jurisdictions with data privacy laws suggests that the EU Directive is the most significant overall influence on the content of data privacy laws outside Europe, and that its influence is gradually strengthening.

As a result, ‘adequacy’ has stopped being a primarily EU concept. Outside Europe, ‘border control’ data export limitations are found in almost all (25/29) data privacy laws in all regions, though their strength varies a great deal, and they are not yet in force in the laws of Malaysia and Hong Kong. Non-EU/EEA European countries also have data export limitations in their law because of the Additional Protocol to Council of Europe Convention 108. So anyone who wishes to criticise the EU for wanting to ‘impose its standards on the rest of the world’ had better level the same accusation at the rest of the world.

There is also, as yet, little indication that the current revisions of the Directive or the Convention will result in Europe abandoning its ‘border control’ approach. The future for European privacy standards, including the ‘border control’ principle of ‘adequacy’ is far more positive than the criticisms they receive might lead us to believe. Attempts to replace the adequacy concept with some notion of ‘accountability’ that abandons ‘border control’, not only goes against the likely direction of reforms of the Directive, but would also involve changing the Council of Europe Convention Additional Protocol, and all non-EU/EEA laws, and almost all data privacy laws outside Europe as well. The inertia that exists against such change occurring is considerable. Like it or loath it, adequacy may be here to stay.

Privacy Enforcement Strengthens in Australia & New Zealand

Graham Greenleaf et al. — Wed, 08 Feb 2012 21:21:06 PST

This article is the first of a series surveying recent Asian and Australasian examples of significant enforcement of data privacy laws. If there are current examples of where privacy laws are achieving significant outcomes in a country, this should make us cautious of the oft-voiced suspicion that ‘privacy laws don't achieve anything’. On the other hand, if such examples are lacking, this raises serious questions. The main sources for such examples are court and tribunal decisions, and the databases of complaint summaries, and annual reports, of data protection authorities.

By ‘significant examples of privacy enforcement actions’ what we mean is as follows. Firstly, the action results from complaints to an independent authority, actions before any Court or Tribunal, or 'own motion' actions by an authority responding to a specific situation. General investigations or reform proposals by authorities are not included. Secondly, the authorities concerned could be Data Protection Authorities (DPAs) or Privacy Commissioners but they could also be telecommunications regulators, financial regulators, government agencies and so on. Independent industry self-regulatory bodies could be included. Thirdly, the result is a significant remedy for an individual or a group of people; or a significant change in (or confimation of) the interpretation of the law with potential remedial benefits; or a significant change in business or government practices.

At present there are well-established data privacy laws covering most aspects of the private sector in nine jurisdictions in Asia and Australasia. This article covers New Zealand and the three Australian jurisdictions. (An article in the next issue will cover the Asian jurisdictions.)

This survey of recent enforcement examples in New Zealand and Australia makes it clear that significant examples of enforcement of privacy laws continue to occur in all four jurisdictions considered, and some examples show the strengthening of particular remedies. However, the mechanisms through which signficant enforcement arises differs a great deal between jurisdictions. In these Australasian examples they include complainant-initiated injunctions, both awards of damages and mediations by Privacy Commissioners, orders by quasi-judicial Tribunals, and suppression orders by Tribunals. One overall factor shared by all four Australia and New Zealand jurisdictions is that payments of financial compensation to complainants are possible and do occur. A comprehensive assessment of enforcement effectiveness would also require statistical information to be considered. Such analysis of enforcement of privacy laws and its effectiveness (covering examples, statistics and mechanisms) is an important aspect of privacy research which is not yet fully developed.

Major Changes in Asia Pacific Data Privacy Laws: 2011 Survey

Graham Greenleaf — Wed, 08 Feb 2012 20:35:01 PST

Nearly a quarter of a century after data privacy laws (or as the Europeans say, ‘data protection’) first appeared in Asia and the Pacific, 2011 was a watershed year, with dramatic developments in the expansion of data protection laws in Asia. This article surveys data privacy legislation developments across Asia (from Japan to Pakistan, and from Mongolia to Indonesia), plus Australasia and the Pacific.

The highlights of these new developments are new data privacy laws in South Korea, Taiwan, Malaysia and India, privacy protections in Vietnam’s new consumer law, and reform proposals in Singapore, Hong Kong, Australia and New Zealand. Legislative action seems to parallel the accelerating scale of threats to privacy, typified by massive data breaches in country after country, but the causal relationship is beyond the scope of this article. The article analyses these development, and the state of play in other countries of the regions, by sub-regions, in order of where the most dramatic recent developments have taken place: South Asia; North Asia; Indo-China; Australasia and the Pacific. The emphasis is on developments over the last 18 months, but background on previous data privacy laws is provided. The article updates Greenleaf, G ‘Asia-Pacific Data Privacy: 2011, Year of Revolution?’ (2011) Kyung Hee Law Journal.

Agents of Change: How the Law ʻCopesʼ with Technological Change

Lyria Bennett Moses — Mon, 06 Feb 2012 18:22:05 PST

The difficulty of adapting legal frameworks to changing circumstances is often represented by images of ʻlawʼ losing a race. Such visions are commonly raised in scholarship concerned with particular problems that arise in applying existing legal rules to new situations, particularly situations involving new technologies. The dilemmas encountered in adapting legal frameworks to technological change rarely persist indefinitely, however. While no institution or methodology is exclusively concerned with changing the law in response to technological change, parliamentary committees, government departments, royal commissions, law reform organisations, technology assessment agencies, ethics bodies, courts, the Productivity Commission and an array of individuals and ad hoc bodies have all been sources of adjustment at various points in history. The diverse array of organisations represents a multiplicity of disciplinary perspectives and evolving methodologies. Each one focuses on part of the story of the mutual adjustment between technology, society and law. This article represents an initial attempt to survey the landscape in order to understand better how Australia has dealt with both technological ʻcrisesʼ and the more mundane process of ensuring that legal rules operate sensibly and predictably in an evolving technological environment. From this, the article will explore briefly the gaps in Australiaʼs current mechanisms for ensuring law ʻkeeps upʼ with technology.

Investor State Arbitration or Local Courts: Will Australia Set a New Trend?

Leon Trakman — Mon, 06 Feb 2012 15:30:02 PST

The Australian Government announced in April 2011 that it will no longer include arbitration clauses in its investment treaties but will provide that investment disputes between foreign investors and host states be heard by the domestic courts of those host states instead. This statement reflects doubts by a developed state about the efficiency of bilateral investment treaties (BITs) in general and investment arbitration in particular. It also raises the question whether other countries will follow particular strategies to suit their discrete needs. One ramification is that resource wealthy states will make tactical decisions, such as entering into BITs only with capital exporting countries, as South Africa has declared.Another is whether developed states will avoid concluding BITs with developing countries whose domestic court systems are unknown or mistrusted.Yet another issue is how a policy statement, such as enunciated by Australia, will impact on its ability to attract foreign investment while protecting its national interests and also its investors abroad.This article deals with these issues, highlighting the significance of competing dispute resolution options in addressing the issues.

U.S. Treaty Anti-Avoidance Rules: An Overview and Assessment

Reuven S. Avi-Yonah et al. — Tue, 31 Jan 2012 08:46:24 PST

In this article, the authors provide a summary of the anti-avoidance rules in the United States that relate to bilateral tax treaties. Specifically, they focus on treaty-based anti-avoidance rules and discuss whether or not a General Anti-Avoidance Rule would be appropriate in this context.

Shareholder Empowerment: The Right to Approve and the Right to Propose

John G. Matsusaka et al. — Thu, 26 Jan 2012 13:10:43 PST

This paper develops a theory to explore the effect of shareholder empowerment on corporate decision making. We highlight important distinctions between the right to approve and the right to propose. Our main implications concern the right to propose: when shareholders can initiate their own proposals, managerial agency problems can be significantly controlled; however, the right to propose can also worsen corporate decisions by inducing managers to inefficiently accommodate extreme shareholder groups. Our analysis suggests that the right to approve managerial proposals (such as director nominations or new investment) constrains managers but not enough to bring about efficient actions. We identify implications of our analysis for a variety of current regulatory issues concerning director elections, proxy access, bylaw amendments, and shareholder voting.

Farewell to Conceptual Analysis (in Jurisprudence)

Andrei Marmor — Mon, 23 Jan 2012 09:50:38 PST

I have two main purposes in this essay: First, to show that conceptual analysis is not nearly as central to legal philosophy as typically assumed. The main methodological thrust of analytical jurisprudence, and in particular of legal positivism, is reductionism, not conceptual analysis. Consequently, the main objections to legal positivism are best seen as arguing against the possibility of reduction. Second, I aim to show that the interpretivist challenges to analytical jurisprudence bark up the wrong tree in this respect, and actually fail to engage with the methodological stance they aim to replace. Along the way I offer a partial defense of reductionism and the limited essentialism that comes with it.

War-Time: An Idea, Its History, Its Consequences

Mary L. Dudziak — Mon, 09 Jan 2012 11:15:20 PST

When is wartime? On the surface, it is a period of time in which a society is at war. But we now live in what President Obama has called "an age without surrender ceremonies," as the Administration announced an "end to conflict in Iraq," even though conflict on the ground is ongoing. It is no longer easy to distinguish between wartime and peacetime. In this inventive meditation on war, time, and the law, Mary Dudziak argues that wartime is not as discrete a time period as we like to think. Instead, America has been engaged in some form of ongoing overseas armed conflict for over a century. Meanwhile policy makers and the American public continue to view wars as exceptional events that eventually give way to normal peace times. This has two consequences. First, because war is thought to be exceptional, "wartime" remains a shorthand argument justifying extreme actions like torture and detention without trial. Second, ongoing warfare is enabled by the inattention of the American people. More disconnected than ever from the wars their nation is fighting, public disengagement leaves us without political restraints on the exercise of American war powers.

This book has just been released by Oxford University Press, and will soon be available elsewhere. This paper contains the Introduction and Table of Contents.

Wisdom of the Ages or Dead-Hand Control? Patentable Subject Matter for Diagnostic Methods After In re Bilski

Rebecca Sue Eisenberg — Mon, 09 Jan 2012 07:43:16 PST

For a quarter century following the landmark 1980 decision of the Supreme Court in Diamond v. Chakrabarty, inventions and discoveries in biotechnology research appeared to be eligible for patent protection, assuming they meet the statutory standards for patent protection. The Supreme Court reopened the issue of patentable subject matter in 2005 when it granted certiorari in Laboratory Corporation v. Metabolite on the question of whether a method of diagnosing vitamin deficiency by observing a biomarker was unpatentable as a “basic scientific relationship.” Although the Court later dismissed the case without reaching a decision on the merits, since that time the Court of Appeals for the Federal Circuit has struggled to discern the limits of patentable subject matter for diagnostic methods in old Supreme Court decisions that had previously seemed destined to languish on library shelves. The Supreme Court reaffirmed the authority of these decisions without explanation in Bilski v. Kappos, thereby demanding formal adherence to stare decisis without following the discipline of common law reasoning. To make sense of these decisions as a guide to the subject matter boundaries of the patent system in the context of contemporary technologies, it is necessary to begin with an account of the functions of subject matter boundaries in patent law. In Mayo Collaborative Services v. Prometheus Laboratories, the Supreme Court has another opportunity not only to clarify the boundaries of patentable subject matter, but to explain what the doctrine of patentable subject matter is all about. This article reviews developments on the issue of patentable subject matter and considers alternative accounts of the work that patentable subject matter doctrine might do for the patent system in the hope of clarifying the application of that doctrine to new technologies with a focus on diagnostic method claims.

Constitutionalising the Franchise and the Status Quo: The High Court on Prisoner Voting Rights

Graeme Orr — Thu, 22 Dec 2011 23:06:11 PST

In recent decades, the ability of prisoners to vote alongside other resident citizens has been a something of a political football, and a much kicked around one at that, in federal politics.

Academic debate has tended to favour prisoner enfranchisement, on multiple grounds. In these accounts, the vote is seen as a fundamental, if not inalienable, human right in international law, whose denial to prisoners is indirectly racially discriminatory. Denying the vote is seen as counter-productive to the purpose of incarceration as social rehabilitation, and not sensibly understood as a form of punishment. There is more than a whiff of the discredited idea of ‘civil death’ about prisoner disenfranchisement.

On the political, and hence legislative front, however, prisoner voting has been fair game. This has chiefly been a symbolic battle, with conservatives seeing prisoners as having seriously breached the social contract. They remain part of the governed, but temporarily forfeit the right to select the governors.

For most of last century, prisoners were disqualified from voting, or nominating or serving as MPs whilst under sentence for an offence with a maximum of one year’s gaol. In 1983 the Hawke government expanded the federal franchise to prisoners whose offences carried a maximum sentence of less than five years. In 1995, the disenfranchisement was eased to an actual sentence of 5 years or more, largely for administrative convenience.

But in 2004 the Howard government reduced this to a three-year rule, in a compromise agreed by Labor. Then in 2006, this became a blanket ban on any prisoner under full-time sentence,4 at least for an Australian offence. Ironically, the voting rights of David Hicks, despite his US conviction on terrorism-related charges, were preserved. A further curiosity of the 2006 legislation was that prisoners were not freed of the compulsion to enrol. Rather, the Australian Electoral Commission (AEC) was to cleanse them from the certified lists for polling day.

The High Court of Australia was invited into this contentious fray by Vicki Roach. An Aboriginal woman who was sentenced in 2004 to six years for burglary including negligent injury and endangerment, Ms Roach had since completed a masters degree. Her case was driven by pro-bono lawyers and run through the Victorian Human Rights Law Resource Centre.

In late August this year, to the great surprise of most commentators, the High Court struck down the ban on prisoner voting. The surprise was a product of both the conservatism of the Court in the past decade, and its longstanding deference to parliamentary sovereignty in electoral matters.

The case was only a partial victory for Ms Roach, however. The 4-2 majority upheld the prior ban on voting by those subject to sentences of three years or more, and hence she will miss voting at the forthcoming federal election.

This note explores the compromise inherent in the Court’s reasoning, and reflects on its wider ramifications for the constitutionalisation of the right to vote given the absence of any mention of such a right in the Australian (or State) Constitutions.

Appropriations and Expenditures: Where do the Limits Lie? Combet v Commonwealth

Alexander Reilly — Thu, 22 Dec 2011 22:34:40 PST

Greg Combet and Nicola Roxon challenged an appropriation of funds for the Commonwealth government’s advertising campaign on Industrial reform in August last year. The Commonwealth maintained that the funds were validly appropriated under the Appropriation Act (No 1) 2005.

Mere Externality Prevails: XYZ v Commonwealth

James Faulkner — Thu, 22 Dec 2011 22:15:49 PST

The plaintiff in XYZ v Commonwealth was an Australian citizen who had beencommitted for trial in relation to offences under ss.SOBA and SOBCof the Crimes Act 19143. In short, it is an offence for an Australian citizen (or resident), while outside Australia, to engage in sexual activity with a person less than 16 years of age.The offences were alleged to have been committed in Thailand in 2001. The allegedvictim was not an Australian citizen or an Australian resident.The plaintiff brought a proceeding to challenge the constitutional validity of ss.SOBA and SOBC in the original jurisdiction of the High Court, naming the Commonwealth as defendant. The plaintiff contended the laws in question are not laws with respect to 'external affairs' within the meaning ofs.S1(xxix) of the Constitution and are therefore beyond Commonwealth legislative power and invalid. The plaintiff sought a declaration to that effect. A case was subsequently stated for consideration by the Full Court under s.18 of the Judiciary Act 1903.

In its submissions the Commonwealth advanced three alternative arguments for validity: -the 'geographic externality' argument - that ss.SOBA and SO BC are laws with respect to a matter physically external to Australia (ie, conduct outside Australia); -the 'external relations' argument- that ss.SOBA and SOBC are laws affecting Australia's external relations with other nations (being laws to curtail 'child sex tourism'); -and the 'international concern' argument- that ss.SOBA and SOBCare laws with respect to a matter of international concern (ie, 'child sex tourism').

The Full Court upheld the validity of the laws in question by a S:2 majority (Gleeson CJ, Gummow, Kirby, Hayne and Crennan JJ; Callinan and Heydon JJ dissenting). The order regarding validity was made at the conclusion of the hearing by the Full Courton 17November200S. Reasons were published on 13 June 2006.

Judicial Review under Section 75(v)

John Basten — Wed, 21 Dec 2011 20:45:38 PST

The 2003 High Court year commenced with the delivery of judgment in two cases heard together the previous September, each involving challenges to the privative clause which was inserted in the Migration Act 1958 (Cth) by the Migration Legislation Amendment (Judicial Review) Act 2001 (Cth). The important judgments appear in Plaintiff S157/2002 v Commonwealth. In the following week the Court handed down judgment in the matter of Ex parte Lam in which five members of the Court reconsidered the doctrine of "legitimate expectation" and indicated a willingness to revisit some aspects of Minister for Immigration and Ethnic Affairs v Teoh. If the tenor of Ex parte Lam was restraint, a more expansive view of procedural fairness was reflected in Dranichnikov v Minister for Immigration and Multicultural Affairs, a judgment handed down some three months later.

Taiwan Revises Its Data Protection Act

Graham Greenleaf — Wed, 21 Dec 2011 20:14:14 PST

Taiwan’s Computer Processed Personal Data Protection Act of 1995 was pioneering data protection legislation in Asia, but had many inherent defects. It had limited coverage, dealing generally with the public sector but only eight specified private sector areas. There was no single oversight body, enforcement being left to the Ministries responsible for each industry sector. Evidence of the enforcement or effectiveness of the Act is lacking, but commentators were of the opinion that the Act is ineffective.

The new Personal Data Protection Act enacted 26 May 2010 is in effect a new piece of legislation. It will not be brought into force until 2012 when the Enforcement Rules necessary for operation of some sections, are expected to be prescribed by the Executive Yuan. The Act is comprehensive in relation to both public and private sectors, and thus much more extensive than the previous Act in relation to the private sector. The revised Act still has no single oversight body, and does not create a data protection authority. Enforcement is left to the Ministries responsible for each industry sector. The obligations imposed by the Act have been considerably expanded, particularly those in relation to notice, and to sensitive data. Data exports (‘international transmission’) by private organisations (‘non-public agencies’) may be restricted by ‘the central competent authority for the relevant industry’ (A 21), but this is not an automatic prohibition on exports. The Act has the first example of an enforceable requirement to notify data subjects (but not the relevant authority) of data breaches enacted in Asian data protection legislation, although the data breach notification provisions in the 2011 Korean legislation is the first to come into force. However, the Taiwanese provision does not apply to all ‘data breaches’, only to those where the company or government agency has breached a provision of the Act. Contraventions of the Act, where damage is caused to another person, can be punished by imprisonment up to two years or substantial fines. Potentially more important are the extensive provisions for damages actions, and for class action litigation (where ‘the rights of multiple subjects are injured by the same causal facts’) by representative organisations which have objectives of protecting personal data. While not as innovative as Korea’s new law, this Act does bring Taiwan up to many aspects of international standards.

East Asian Financial Integration: A Road Ahead

Ross Buckley — Wed, 21 Dec 2011 17:59:29 PST

ASEAN plus China, Japan and Korea have agreed to expand dramatically the scale of the Chiang Mai Initiative of bilateral swap arrangements and develop a more broadly focused institution. This could be a substantial step on the journey towards an Asian Monetary Fund (‘AMF’). This paper examines what a fully fledged AMF would offer the region. The national economic policies of East Asian nations have differed substantially from those of the Washington Consensus, and been more effective. An AMF would offer the chance to promote economic policies in Asia that give a larger role to national government, equity investment and domestic demand, and a smaller role to foreign debt financing and export revenues, than do those of the Washington Consensus.

A Financial Transactions Tax: Inefficient or Needed Systemic Reform?

Ross Buckley et al. — Wed, 21 Dec 2011 17:36:14 PST

The European Commission has included a Eurozone financial transaction tax in its longterm budget, as a first step towards a global tax. This move was taken despite negative European Commission and International Monetary Fund staff reports, which concluded that a tax would reduce the efficiency of capital markets, and raise the cost of capital. The efficiency frameworks used in the staff reviews were unduly narrow. Markets work best when there are strong links between market trading and real economic activity. Of late, these links have become increasingly tenuous and latent market and financial system risks are mounting. Carefully calibrated legal and tax responses are required to change market behaviour. Such a tax as part of an integrated policy framework would reduce short-term momentum trading and promote longer-term investment that would better reflect underlying economic fundamentals. So we argue the European Commission is correct in proposing to adopt such a tax.

The Dodd–Frank Wall Street Reform and Consumer Protection Act Will Require a Change in Regulatory Culture and Mindset to be Effective

Gill North et al. — Wed, 21 Dec 2011 16:38:06 PST

The Dodd-Frank Act constitutes the most significant reform of financial regulation in the United States since the 1930s. Some of its provisions are bold, particularly in the areas of consumer protection and derivative trading. However, the political challenges for law reformers and regulators in the wake of the global financial crisis are far from over. The Act is inchoate. The full scope and nature of the new financial regulatory system will take several years to evolve as the mandated studies and rule making are completed and implemented. We argue that the extent to which the reforms achieve their stated objectives will depend most critically on three factors: (i) the competency, integrity and forcefulness of the federal regulators, (ii) their ability and willingness to supervise the finance industry on an integrated basis, and (iii) a fundamental change in the regulatory culture and mindset.

Financial Sector Levies and Taxes: Critical Choices for China Domestically and in the G20

Ross Buckley — Wed, 14 Dec 2011 22:17:05 PST

The Global Financial Crisis (GFC) sparked vigorous debate on the role of financial institutions and capital markets, and the extent to which such institutions and markets should contribute to the broader economy. Much of this debate has centred on what might be the appropriate mechanisms to enable governments to recoup taxpayer monies used to bail out failing institutions and to restimulate their economies in the aftermath of the crisis. Proposals that have been considered at an international level over the last couple of years have included financial institution levies (such as a financial stability contribution), a financial activities tax (FAT) and a financial transaction tax (FTT).This research project will therefore explore what positions China might most usefully adopt with respect to the global push, and provide an initial outline on global capital market trading and explain the general principles and concerns that underpin the need for an FTT.

30 years on: The review of the Council of Europe Data Protection Convention 108

Sylvia Kierkegaard et al. — Wed, 14 Dec 2011 21:06:54 PST

The Council of Europe celebrates in 2011 the 30th Anniversary of its Data Protection Convention (usually referred to as Convention 108) which has served as the backbone of international law in over 40 European countries and has influenced policy and legislation far beyond Europe. It is the only legally binding international treaty dealing with privacy and data protection. With new data protection challenges arising regularly, the Council is revising Convention 108 to attempt to meet and overcome these challenges. This paper was a joint submission by its authors on behalf of Computer Law and Security Review (CLSR), the International Association of IT Lawyers (IAITL) and ILAWS, University of Southampton, in response to the Expert Committee’s public consultation on the Convention. Some of the main submissions made are: • The Convention should remain a simple, concise and technologically neutral instrument, while at the same time recognising and addressing some new characteristics of the present and future technological environment. • It would not be helpful to try to define the right to privacy in a data protection Convention. It would be helpful to include “collection” in the definition of automatic processing so that all of the principles apply, where relevant, to collection. Both the proportionality principle (which should apply to all operations carried out on the data) and the data minimisation principle (which aims at limiting the collection of personal data to a strict minimum or even to cease personal data collection when possible) are significant principles which could valuably be added, and we strongly support their inclusion. • A right to be forgotten in respect of online data (that is, people should be able to give informed consent to every site or service that processes their data, and they should also have the right to ask for all of their data to be deleted). • The concept of consent, if it is used, it needs to be expressly defined as meaning free, voluntary, informed and revocable at any time, and not bundled with other consents. • Compatibility (of secondary uses) is a subjective concept, and would be better expressed as “uses or disclosures” which are within the reasonable expectations of the data subject (to which a “reasonable person” test would be applied). • Full application of privacy principles to the behaviour of private individuals would be onerous and oppressive e threatening other important freedoms and rights, but some controls and restrictions are justified. This is best handled by a broad statement of privacy protection in the ECHR and similar human rights instruments, at the international level. • A right for data subjects to be informed of data breaches affecting them that meet specified threshold criteria should stand alone as a separate principle. • There would be no need for separate principles or rules for traffic or location data if personal data is defined as expressly including any information which enables or facilitates communication with a person on an individualised basis, whether or not it meets the current definition of personal data. • There should be an obligation to demonstrate that measures have been taken to ensure full respect for data protection rules, but “accountability” cannot be and must not become an alternative to data export restrictions. • Allowance for anonymity should be made a basic data protection principle in itself, with pseudonymity as the first fall-back option when anonymity cannot be achieved for legal or technical reasons. • One particular task of a supervisory authority that needs to be spelled out is the obligation to account for their performance of their complaint investigation obligations, including by reporting to the public, on objectively determined criteria, of cases investigated (anonymised to the extent necessary to protect privacy but not otherwise), and by statistics including those on outcomes and remedies. • It remains appropriate to require an adequate level of protection as a condition of cross-border transfer.