ICDPPC 2019

CLOSED SESSION

WORKING GROUPS FORWARD LOOKING PLANS

COMPENDIUM

1

Contents – Forward Looking Plans

1. Future of the Conference Working Group 4

2. New Permanent Working Group on International Enforcement Cooperation

5

3. Digital Citizen and Consumer Working Group 9

4. Digital Education Working Group 14

5. Artificial Intelligence Working Group 17

6. Data Metrics Working Group 20

2

Future of the Conference Working Group

Subject to Conference’s approval at the 2019 Annual Meeting in Tirana, the following actions have been identified for 2019 – 2020:

Secure Online Platform:

November – December 2019: Launch a short survey amongst the member authorities to test members’ views on the need for the secure virtual space as well as for further scoping out the requirements and functionalities members would like to see on the platform; further explore the availability and scope of use of open source software or institutional collaboration solutions before taking steps towards the implementation of an entirely new ICDPPC website;

January – March 2020: On the basis of the results, engage in a soft market testing to acquire more accurate figures required for the development of the secure online platform, as well as for carrying out a thorough risk assessment of the proposed approach;

April – May 2020: explore funding options to cover the costs of the creation of the secure online platform to present at the 2020 Annual Meeting;

Proposed Plans for the Establishment of a stable and funded Secretariat:

November 2019 – March 2020: gather the necessary census data from all member authorities in order to establish the relevant fee tier and conduct a survey amongst member authorities to identify legal obstacles for some authorities to accept funds for running the Secretariat;

April 2020 – May 2020: analyse survey results; reach out to those authorities which provided a Secretariat function in the past to collect information over costs incurred and tasks undertaken; explore options for alternative sources of funding which could complement the income sourced through the collection of the Secretariat fees; draft report to be circulated to the Conference at the 2020 Annual Meeting;

June – July 2020: consultation period.

3

New Permanent Working Group on International Enforcement Cooperation

1. INTRODUCTION

1.1 PURPOSE OF THE OVERVIEW DOCUMENT

Pillar #2 of the ICDPPC Strategic Plan recommends that the Conference review and refresh the objectives of the International Enforcement Co-operation Working Group (WGIEC) and make it permanent.

All working groups as a matter of necessity must produce a document setting out the propose mission and objectives for the working group.

The UK Information Commissioner’s Office as sponsor of ‘the Resolution on the Promotion of New and Long Term Practical Instruments and Continued Legal Efforts for Effective Cross Border Cooperation in Cross Border Enforcement,’ has agreed to produce this overview, explaining where and why the working group will target its resources in the period up until October 2020.

It is proposed that this document is used to inform the conference’s decision making and understanding of the role of the proposed working group. This overview should be read alongside the Conference Strategic Plan and the Resolution for the ‘new’ WGIEC.

2. BACKGROUND

As we find more and more authorities investigating similar and/or overlapping issues, improving the way we cooperate with each other to minimize duplication of investigatory effort becomes more important than ever.

There is increasing interest in the use of enforcement co-operation tools but a wide divergence of practice and capacity. Data Protection authorities are increasingly investigating large scale breaches with cross border impact and cooperating informally on cases of mutual interest. Just as technology has moved apace, so has the location of data, the growth in DPAs and developments of existing laws.

Through its work, the WGIEC will aim to build an environment for international privacy enforcement authorities to exchange investigative experience and improve day to day practical enforcement cooperation. Building upon the efforts of the previous working group and others the group will test methods in which we can minimize duplication of investigatory effort and identify opportunities to accelerate inquiries through practical cooperation.

4

As well as reduced duplication, the effort of the working group will aim to provide, where possible, consistency for businesses in our investigatory approach.

Time will be dedicated in the Closed Session of the annual meeting to test the proposed WGIEC future approach.

3. PROPOSED MISSION and OBJECTIVES

3.1 MISSION

Provide leadership and full delivery of Pillar # 2 of the Conferences’ Strategic Plan on behalf of the Executive Committee, working with other networks to develop and deliver the Conference’s enforcement cooperation ambitions.

3.2 OBJECTIVES

The WGIEC will:

1. Strengthen the Community’s approach to investigating issues with global reach, promote the advantages of reciprocal mutual assistance and explore opportunities for joint investigations.

To prevent inconsistency and duplication the group will focus on establishing practical arrangements that facilitate the exchange of useful information and evidence, resources and analyses. Longer term this would ideally include mutual support / assistance and recognition for each other’s work and findings to avoid where possible multiple sanctions for organizations.

2. Build a safe, secure, and inclusive environment for authorities to share intelligence, investigative strategies and approaches.

- There are an increasing number of authorities cooperating internationally on investigations. Those authorities are collaborating on investigations and coordinating their response within existing enforcement cooperation arrangements. In some circumstances this includes the sharing of personal data but in many cases it does not. With the use of existing frameworks privacy enforcement authorities internationally are actively engaging in bilateral and multilateral enforcement cooperation activities; Working to share lines of enquiry, amplifying each other’s investigations and providing consistency for industry.

- Increasingly the value of cooperation is in the exchange of resources and operational experiences related to regulating a specific sector or organization not necessarily in the sharing of personal data. Where possible the WGIEC will promote opportunities to pool resources, share lessons learnt and investigatory approaches. The WGIEC

5

group will promote a strong message of coordination and consistency in enforcement cooperation within existing arrangements. Members will promote the benefits of strong enforcement cooperation, by modelling good practice, working jointly on investigations and taking advantage of opportunities to combine efforts and coordinate our approach and regulatory response.

- Rather than individual authorities doing their own separate research and inquiries, the group will look to convert established cooperation frameworks into processes and procedures that enable practical day to day support thus providing authorities with a clear set of guidelines on how to make focused, realistic cooperation requests when the time comes.

3. Promote the advantages of WGIEC membership and ensure an understanding of the differing regulatory powers and tools available to each jurisdiction with the aim of strengthening cooperation and coordination.

Many countries have new DPAs and many are updating their arrangements. It is important for DPAs to keep themselves updated as to their colleague’s powers, tactics and mode of operations.

The Working Group will continue to take forward and build upon the work of the current group to produce and maintain a repository of enforcement cooperation resources and tools at our disposal.

Longer term there may be merit in reviewing the legal solutions for enhancing enforcement cooperation on an international level, however, given the practical challenges in creating such a solution and the number of DPA’s already having signed up to similar instruments including the APEC’s CPEA, and Council of Europe’s Convention 108+ - we do not propose that this work stream is taken forward.

The WGIEC does not intend to duplicate the efforts of other established cooperation networks, be it the Global Privacy Enforcement Network (GPEN), the International Data Protection Conference Digital Consumers and Competition Working Group (DCCWG), the Berlin Group, Unsolicited Communications Enforcement Network (UCENET), or the Common Thread Network (CTN), rather, it will aim to work with chairs of these networks to clarify their objectives and identify opportunities to streamline activity.

NEXT STEPS

6

- In the event the conference adopts the resolution to establish the new WGIEC, the working group members will produce a set of terms of reference and work plan for approval by the Executive Committee.

7

Digital Citizen and Consumer Working Group 1) Background

The Digital Citizen and Consumer Working Group (“DCCWG”) studies the intersections between privacy/data protection, consumer protection and competition. It was established via a resolution passed at the 39th International Conference of Data Protection and Privacy Commissioners (“ICDPPC” or “International Conference”) and a second resolution was passed at the 40th International Conference which renewed and confirmed the mandate of the DCCWG to continue the study of these intersections.

The DCCWG is presenting a resolution at the 41st International Conference to renew and confirm the DCCWG’s mandate for a further two years.

2) Forward Plan for the Working Group 2019-2020

The DCCWG is proposing a resolution at the 41st International Conference which provides the key tasks to be undertaken by the DCCWG in the following two years (attachment A).

Regulatory Co-operation

At the heart of the DCCWG’s work is a recognition of the importance of regulatory co-operation in protecting personal information. Not only is this regulatory co-operation achieved between Data Protection and Privacy Authorities, but it also seeks to raise awareness and establish relationships between Data Protection and Privacy Authorities and Consumer Protection and/or Competition Protection Authorities.

The long term goal for the DCCWG includes advancing the will and realizing the mechanisms to collaborate with enforcement partners across regulatory spheres, with a view to having holistic and efficient regulatory outcomes that provide a greater scope of coverage for consumers from privacy, consumer protection and competition risks.

The forward work plan of the DCCWG also seeks to achieve outcomes in both the Enforcement Co-operation and Policy Theme pillars identified in the 2019-2021 Strategic Plan of the International Conference.

Policy Themes

The DCCWG has, in its work over the past two years, identified certain areas of substantive overlap – for example:

i. Where the aims of Consumer Protection provisions may be closely aligned to those of Privacy and Data Protection:

8

a. The requirement not to deceive, via false or misleading representations or material omissions; vs. the requirement for transparency or to obtain meaningful consent.

b. The requirement not to use data in a way that would be unfair or harmful to consumers; vs. the requirement not to use information for illegitimate purposes and to properly safeguard information.

ii. Where Competition and Privacy / Data Protection laws have mutually relevant implications:

a. Privacy implications resulting from mergers, or market concentration more generally.

b. Competition implications resulting from privacy-law requirements, including where privacy may be a non-price element of competition.

Further work remains to be done by the DCCWG to better understand these, and other, common policy themes or substantive areas of mutual relevance to data protection and privacy authorities and consumer/competition authorities, with a view to providing opportunities and developing strategies further collaboration in those areas.1

This aim will be achieved by the continuation of mapping overlaps between data protection and Privacy authorities and consumer/competition authorities in different jurisdictions.2 In particular, the DCCWG seeks to conduct and summarize legal research comparing privacy and data protection laws to those for competition and consumer protection, with a view to identifying potential overlaps and/or conflicts.3

Enforcement Cooperation

The DCCWG workplan outlines opportunities for data protection authorities and consumer/competition authorities to develop the capacity to move forward in a co-ordinated approach to enforcement, to ensure that citizens of the global economy are kept safe.

The DCCWG is seeking to ensure that data protection authorities are aware of competition/consumer issues and vice versa. This work will require the continuation of DCCWG’s current work to sensitize authorities and networks to the intersections between privacy, consumer protection and competition.4

The DCCWG will also seek to identify collaborative strategies, tools and vehicles that could support further cross-regulatory cooperation, with particular focus on those areas of substantive overlap outlined above.5

1 Refer to ICDPPC 41st Conference, Proposed DCCWG Resolution, paragraphs 3(b), 4, 5 2 Refer to ICDPPC 41st Conference, Proposed DCCWG Resolution, paragraph 13 Refer to ICDPPC 41st Conference, Proposed DCCWG Resolution, paragraph 14 Refer to ICDPPC 41st Conference, Proposed DCCWG Resolution, paragraph 2.5 Refer to ICDPPC 41st Conference, Proposed DCCWG Resolution, paragraph 3.

9

To these ends, the DCCWG will continue to engage, through meetings or workshops, with relevant networks, such as the Organisation for Economic Co-operation and Development (“OECD”), the Digital Clearinghouse (“DCH”), the Global Privacy Enforcement Network (“GPEN”), the International Consumer Protection Enforcement Network (“ICPEN”), the International Competition Network (“ICN”) and the European Consumer Protection Cooperation Network (“CPC Network”).

The DCCWG may also administer a common questionnaire to be answered by both data protection authorities and consumer/competition authorities on data protection issues and consumer/competition issues which may arise in both fields. Such questions may be around the definition of data controller/data processor in a multi-sided market, fairness and the use of consent, the impact of data protection authorities’ actions/decisions on markets, definitions of harm, enforcement powers, and different rights and types of infringements under each regime.

It is envisaged that the DCCWG will recommend and advocate for collaboration tools and/or mechanisms where they do not exist, such as an avenue by which data protection authorities and consumer/competition authorities are able to share information, such as answers on issues within the other regulator’s field.6

Finally, the DCCWG seeks to engage with our fellow ICDPPC members of the Working Group on International Enforcement Cooperation (“WGIEC”) with a view to reflecting, in the Enforcement Cooperation Handbook, lessons learned regarding potential tools and strategies for cooperation where there is a cross-regulatory intersection.7

This will culminate in a recommended strategy for collaboration that will allow privacy and data protection authorities and consumer/competition authorities to more effectively achieve their respective aims.

Reporting

The DCCWG will provide an oral update and presentation on its workplan progress at the 42nd Conference, and a written report to the Conference at the 43rd Conference detailing the outcomes of its work over the previous two years (2019-2021), including lessons learned and any recommendations for further work in this area.

6 Refer to ICDPPC 41st Conference, Proposed DCCWG Resolution, paragraphs 3(a), 4, 5. 7 Refer to ICDPPC 41st Conference, Proposed DCCWG Resolution, paragraph 4.

10

ATTACHMENT A

RESOLUTION TO SUPPORT AND FACILITATE REGULATORY CO-OPERATION BETWEEN DATA PROTECTION AUTHORITIES AND CONSUMER PROTECTION AND COMPETITION AUTHORITIES TO ACHIEVE CLEAR AND CONSISTENTLY HIGH STANDARDS OF DATA PROTECTION IN THE DIGITAL

ECONOMY

41st International Conference of Data Protection and Privacy Commissioners21-24 Tirana, Albania

AUTHORS:

The Office of the Privacy Commissioner of Canada (OPC) and the Office of the Australian Information Commissioner (OAIC) – on behalf of the Digital Citizen and Consumer Working Group.

CO-SPONSORS:

National Privacy Commission, Philippines Norwegian Data Protection Authority, Norway Information Commissioner’s Office, United Kingdom European Data Protection Supervisor Federal Commissioner for Data Protection and Freedom of Information, Germany Belgian Data Protection Authority, Belgium Commission Nationale de l’Informatique et des Libertés, France

NOTING that:

A. Statutory protections for individuals, whether as citizens or consumers, are imbedded in consumer protection, privacy and data protection laws;

B. The Conference’s strategic priority to advance global privacy in the digital age by ensuring regulatory co-operation in achieving clear and consistently high standards of data protection, includes the strengthening of our connections and working with partners to achieve our mission of supporting authorities more effectively to include the protection of personal data in their mandates;

C. The Conference is committed to addressing the challenges related to privacy and data protection in the digital age;

D. Individuals are increasingly concerned about their lack of control over, and information about how, their information is processed and protected in the online environment;

E. Data protection authorities should cooperate with appropriate bodies that have an impact on, and can further the goal of protecting the rights of the individual in relation to their personal data;

11

F. Personal information is increasingly a core part of business models in the digital economy;

G. Privacy and data protection have become material considerations informing consumer decisions in the digital economy; and

H. Accordingly, there is a growing intersection of privacy, consumer protection, and competition issues.

RECALLING that:

I. The 39th and 40th Conferences resolved to identify the need for, and highlight ways to improve, collaboration between data protection and consumer protection authorities at both domestic and international levels with a view to fostering better protection for citizens and consumers in the digital economy.

HAVING made substantive progress by meeting the commitments of prior resolutions:

The 41st Conference resolves to renew and confirm the mandate of the DCCWG, for a period of two years, with a particular view to:

1. Continue to explore, understand and map the substantive overlaps between legislation regulating the data protection and/or privacy rights of individuals and legislation regulating competition or consumer protection laws, with a view to better understanding common policy themes identified by the DCCWG, and identifying further common policy themes.

2. Further sensitize authorities and networks to the intersections between privacy, consumer protection and competition such that competition and/or consumer protection authorities and data protection/privacy authorities can recognize the underlying principles which the different regulatory frameworks are subject to and can apply these principles into their regulatory activities to improve their enforcement practice.

3. Identify strategies, tools and collaboration vehicles that provide for cooperation across regulatory spheres, including actions which seek to:

a. provide an avenue for competition/consumer authorities to seek answers on data protection/privacy issues, and vice versa.

b. collaborate on common policy themes or topics.

4. Identify, recommend and/or advocate for such tools and instruments where they do not exist.

5. Support and facilitate collaborative initiatives across regulatory spheres.

6. Provide an update to the 42nd Conference on the working group’s progress, and report back to the 43rd Conference on the elements listed above and if necessary, submit a resolution proposing specific measures or further concrete work.

12

Digital Education Working Group

Action 1: Adaptation of the Data Protection Competency Framework

Suggested follow-up actions for 2019–2020:

→ The DEWG continues the exchange of experiences to build on successful and replicable initiatives to integrate educational packs, lesson plans and practical cases by age groups into school curricula and the roll-out of the framework’s key data protection competencies in various subject matters to be tracked over a longer period of time to monitor success and impact.

Action 2: Awareness-raising on the direct exercise of digital rights by children themselves

Suggested follow-up actions for 2019–2020:

Children’s rights online and exercising of their rights

→ The DEWG will build on the results of the 2019 survey, taking into account the results of the study listing best practices on information and access procedures to consider extending these statements in a draft resolution by our authorities as a key mover impacting the UN Convention on the Rights of the Child, calling upon the United Nations policy to supplemented these texts since any part relating to the protection of digital rights is being absent from them.

→ Continue the exchange of experience on national initiatives focused on the rights of children (relating to reports, consultations, surveys, and/or recommendations of Design thinking).

→ See the list of other related proposals on this topic in the Forward Looking Plan (2019-2021) at the end of the report.

Action 3: Implementing the Resolution on e-learning platforms

Suggested follow-up actions for 2019–2020:

E learning in educational activities:

→ Continue to track the progress of interactions with relevant stakeholders in the field of education and the industry over a longer period of time to monitor success and impact in the adoption of Codes of Practice, lessons learned, and contribute to an understanding of why some initiatives may not have been adopted with a view to helping plan future initiatives by our authorities in this area.

→ Prepare an inventory of Recommendation Guides and Codes of Practice drawn up by the member authorities.

AI and Learning Analytics in the field of education:

→ The work surrounding learning analytics is part of a wider reflection on online education platforms in schools. As an emerging issue associated with the stakes inherent in the development of learning analytics in the Education sector, it should definitely be explored over the next few years (as demonstrated by the preliminary results of the CNIL survey in July 2018).

13

→ the DEWG should consider whether this topic is strongly supported by DPAs as a priority in the 2019-2020 Action Plan Program or at a later stage (e.g. in the Forward looking plan), then establish a task force and look into this area to develop where necessary some activities in coordination with the Ethics and Data Protection in AI Working Group.

Action 4 : Evolution of the CIRCABC online platform

Suggested follow-up actions for 2019–2020:

→ Explore the suggestion of organising a short campaign to mobilize at a fixed period DPAs who would be invited to download their latest and successful pedagogical resources on CIRCABC. → In the absence of other prospects for sharing resources on existing public platforms identified, consider a possible transfer of content from CIRCABC to a future platform of the international conference, as definitely presenting the best option in the medium-/long-term for permanent visibility and a public sharing of resources aimed at the educational community.

→ Furthermore, special attention deserves the example of new e-learning platforms e-OpenSpace that will be made accessible in Autumn 2019, offering specifically data and privacy educational materials, presentations, documents, and ready to use training materials ; this initiative has been developed within the framework of the Erasmus + project entitled «e-OpenSpace - European Innovative Open Platform for Electronic Networking and Sustainable Provision of Adult Centred Education in Privacy and Personal Data Protection» conducted by the transnational consortium led by the Bulgarian, Croatian and Polish Commissions together with University and NGOs partners.

* * * * * *

Forward looking Plan for the DEWG which should consider views of the members (ICDPPC Strategic Plan 2019-2020 expected for the annual Conference):

Mapping data protection issues around children’s rights online including, among others, references to the following initiatives:

- The UN Convention on the Rights of the Child: the Committee on the Rights of the Child has decided to develop a General Comment on children’s rights in relation to the digital environment and welcomes the submissions of all interested parties as a contribution to this important work.

- The current revision of the"2012 OECD Recommendations on Children in a connected world".

- The current Strategy for the Rights of the Child (2016-2021) of the Council of Europe including the rights of the child in the digital environment as one of the priority areas (implementation until 2021) in connection with the Ad hoc Committee for the Rights of the Child (CAHENF).

- Research projects related to “Children’s rights perspective on privacy and data protection in the digital age” (Ghent University; LSE – ICO, etc.).

- The Council of Europe has implemented strategies over cycles to guide its work on children’s rights and Digital Citizenship Education :

14

The newly adopted Recommendation CM/Rec(2018)7 of the Committee of Ministers to member States on Guidelines to respect, protect and fulfil the rights of the child in the digital environment.

- The ongoing "Toolkit" to raise awareness of youth to the protection of their privacy and their personal data in the digital environment by the Data Protection Unit and the Children's Rights Division of the Council of Europe.

- The Digital Citizenship Education Handbook: Being a Child in the Age of Technology published in April 2019 by the Education Policy Division of the Council of Europe, to be supported by a new draft DCE Recommandation planned for adoption over 2019-2020 and other working tools intended to assist its implementation.

15

Artificial Intelligence Working GroupDraft Work program

The secretariat presented a first version of the Draft Work Program (DWP) in June 2019. Based on feedback from the co-chairs and members of the WG, a second draft was discussed in July 2019. Currently, the WG members are in the process of determining their participation in the scheduled actions and possible refinement of the intended objectives. WG members will also welcome feedback from other delegation and observers.

The DWP covers the period from 2019 to 2021. It defines a number of support actions and deliverables and a rough schedule for their completion. The subsequent table provides an overview of the activities.

16

17

*The WG discussed that caution must be applied when addressing actions 9 and 10, referring to environmental and socio-economic harms that AI may pose. Concerns of some members referred to questions of how to speak on these matters from the perspective of data protection as the WG’s area of expertise. With the aim to support responsible use of AI that protects the data privacy of individuals, embedded in broader discussions on AI ethics, it was suggested to opt for a surgical focus on key points relevant to the WG’s field of expertise and/or collaboration with other regulators operating in the respective subject fields.

Forward Plan for the Working Group 2019-2021

Taking account of any feedback from delegations and observers in Tirana, as well as from the actions of member authorities in the domain of AI, the WG plans to further elaborate on the substance and schedule of the programmed actions, and to ensure transparent and timely exchange with the members and observers of the ICDPPC.

18

Data Metrics Working GroupRecommendations

The ICDPPC Data Protection Metrics working group recommends that the Conference agree to:

1. endorse four questions in the core areas of public awareness privacy law and authorities, trust in public and private sectors, awareness of data protection and privacy rights, and

2. create an exclusive webpage on the Conference website as a resource on Data Protection Metrics which would serve as a repository of the results of surveys undertaken by Conference members and list all the community attitude surveys made available with this report.

19