Will the boat come in for privacy law reform in 2012?

Throughout 2011 we saw some promise for better, updated privacy laws in many parts of the world, with changes afoot in the EU, the USA and Australia. While in the end things were still ‘promising’, 2012 looks set for some real progress, according to Malcolm Crompton.  

To quickly reprise, early 2011 I wrote in my blog Towards a Global Privacy Framework: Arriving at Base Camp about the forthcoming G8 summit, which had privacy on its agenda. In May, I updated this observation by blogging that the world’s leaders were Getting closer to Base Camp: the Sherpa’s are unpacking the tents. The final Summit communiqué did ‘encourage the development of common approaches’. Well, it was a start. 

But the momentum seemed to be building. Elsewhere at the global level, in November 2011, APEC Ministers announced , APEC Leaders endorsed the complete APEC Data Privacy Pathfinder Cross Border Privacy Rules System (CBPR). This is the first cooperative arrangement to protect personal information when it moves between jurisdictions (outside the rather unique circumstances of the European Union). It is the culmination of nearly a decade of concerted effort since APEC first considered developing its own Privacy Framework.

Meanwhile, in the US, most recently in August 2011, a White House Office of Science and Technology Policy spokesperson indicated that the US Federal government would play a role in protecting internet consumers, with a business-friendly regulatory structure.

And in Australia, there was progress of sorts as well. 

Rather optimistically, in July I blogged to the effect that Privacy law reform in Australia gets going again. By year’s end, the Senate Finance and Public Administration Committee had received and reported on one more piece, the credit reporting provisions.

• the main data protection framework is a Regulation and not a Directive. The Regulation will be enforceable in member states after two years. A Directive would have required each of the member states to make law, and would have left in place the scope for interpretation and inconsistency between the member states. Interestingly, the law enforcement aspect of the new regime will be regulated by a Directive rather than a Regulation.
• penalties will range from a warning letter up to €1 million/up to 2% of the offending company’s global turnover. Although lower than the fines of 5% of turnover indicated in leaked earlier drafts, these are nonetheless significant penalties
• there will be a ‘one-stop shop’ approach to enforcement, with each company subject to the Data Protection Authority in the member state in which it has its main presence
• the reforms contain an online ‘right to be forgotten’ where online data can be deleted when there is no legitimate reason for it to be kept