Designing and formulating data protection laws

International Journal of Law and Information Technology

Volumn 18, Issue 1, 2010, Pages 1-27

  Schartum, Dag Wiese ^a  

^a UNIVERSITY OF OSLO   (Norway)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 77953559041     PISSN: 09670769     EISSN: 14643693     Source Type: Journal    
DOI: 10.1093/ijlit/ean013     Document Type: Note

References (46)

1. Cf. A. Michael Froomkin's article in the Stanford Law Review, vol. 52, p. 1461 - 1543.
2. See Ravlum 2005.
3. Controllers were even asked about camera surveillance. According to the DPA, camera surveillance should be reported to the Data Inspectorate prior to start-up. The poll shows that 20% of controllers with camerast had not notified the Inspectorate, while 43% answered that they did not know if notification had been sent.
4. Cf. Flash Eurobarometer 2003. Questions regarding controllers' actual implementation of national data protection laws were not asked.
5. Cf. Bygrave 2002 p. 23.
6. Cf. Bygrave 2002 p. 21.
7. In striking contrast to "privacy enhancing technology" (PET), see Froomkin 2000
8. Flaherty 1998 p. 171.
9. See Ravlum 2005, table 4.6.
10. 19% gave a neutral response and 4% did not know.
11. See Ravlum 2005, table 4.6. 21% did not know.
12. Council of the European Union, Brussels, 27 September 2006, 13246/06
13. The objectives to establish and expand the internal market, increase economic and social inte- gration, and thereby the need to exchange personal data between the 30 countries of the EU and the European Economic Area (see Preambles 5 and 6 of the Data Protection Directive, Art. 1 Section 2). The objective of fighting organised crime and terrorism.
14. The term " regulation" is used in a rather narrow sense of government trying to control the level of data protection by means of legislation.
15. Froomkin 2000 p. 1501.
16. Viewed pragmatically, data protection regulations could of course be limited to dealing with the negative effects of problem sources. This, in my view, is obviously unacceptable as a basis for an analytical approach.
17. The "NAV-reform". For information about the reform in English: http://www.nav.no/page?id=1073743655.
18. Another question is of course the influence ICT will have on the shaping of the reform once it has been initiated.
19. I will not bore the reader by explaining figure 3 counter-clockwise.
20. The legislature has limited powers to decide the organisation of the Government and subsidiary agencies
21. This is especially true for Ministries. Directorates and Inspectorates are often created by law, but the detailed organisational arrangements lie outside legal regulation.
22. Cf. the proposal of the Council of the European Union 2006.
23. Penal provisions may be integral parts of the other types of regulations too (categories A - D), but such provisions only apply within the substantive scope of each Act
24. Act relating to personal health data filing systems and the processing of personal health data (18.5.2001 No. 24). Other laws under category B are proposed (regarding personal data in the police sector and health research), cf. the reports NOU 2003: 21 "Kriminalitetsbekjempelse og personvern" and NOU 2005: 1 "God forskning - bedre helse" .
25. E.g. the National Cancer Registry.
26. Act relating to personal health data filing systems and the processing of personal health data contains parallel regulation in the health sector
27. Act of 16 January 1970 No. 1.
28. A couple of specific references to the DPA are, however, inserted in regulations pursuant to the Act
29. Regarding freedom of information, processing for strictly private/personal activities/purposes, processing of cases in the police and law courts pursuant to rules of court etc
30. This is, however, not to claim that politicians would agree that the application of the Act yields satis-factory and fair results!
31. In Norway, there is, however, no such special regulation today. The DPA will (probably) apply to all such processing, except the processing of personal data by the police as part of a judicial case.
32. Filing systems are only linked to the manual processing of personal data, see DPA Section 3.
33. In Norway, one simple estimate counts more than 80 regulations pertaining to various filing systems, cf. survey available from http://www.personvern.uio.no/pvpn/regler/index.html.
34. Cf. DPD Art. 7 (e).
35. The strategy described here has been partly applied in the Norwegian WEA of 2005. However, special regulations are limited to provisions regarding "objectively justified" controls and evaluation of control measures, as well as to two specific provisions regarding health information and medical examination of employees.
36. See, for instance, article in The Washington Times, available from http://www.washtimes.com/ business/20030521-094809-8963r.htm.
37. See DPA, Section 48
38. It is assumed that the section includes situations where information is made accessible to everyone over the Internet, for instance, on web pages with free access. However it does not cover every kind of widespread distribution of information. Furthermore, the provision is not particularly linked to the application of electronic devices. See Schartum and Bygrave 2004 p. 240.
39. Cf. Burkert 1998, p. 125 and OECD 2003 p. 4.
40. See, for example, Bennett and Raab 2006, p. 177 - 2002.
41. See Schartum 2001, where the same approach is the basis for a discussion concerning privacy enhancing use of ICT to empower and assist data subjects
42. See "legal decision systems" and "legal decision-support systems" respectively, Schartum 1995
43. See Schartum 1995.
44. As in Norway and many other countries
45. A similar model has been proposed for the processing of personal data related to health research, see report from an expert committee in NOU 2005: 1 "God forskning - bedre helse", Chapter 9
46. Cf. Significant increases in connection with Internet technology, biometrics, e-government, the fight against terrorism in the wake of 9-11 2001 etc.