European Privacy Overview - 1890 until 2014

1890- 2014 P. European rivac су OVERVIEW PRIVACY ENFORCERS IN THE EU: A COMPARATIVE STUDY OF NATIONAL DATA PROTECTION AGENCIES' (DPAS) ANNUAL REPORTS (LATEST AVAILABLE) Why did we do this? The upcoming EU Personal Data Protection Regulation (#EUDataP) continues to be heavily debated and will have to be enforced by local DPAS. However, these DPAS work very differently! Mind Your Privacy wanted to understand & share those differences for Data Protection Day 2014. Legislative milestones and the creation of DPAS The evolution of the Privacy concept, from the “Right to be Left Alone" to a recognized Human Right. Universal Declaration of OECD. Guidelines on the Protection of Privacy and Transborder Flows of Personal Data Human Rights (UDHR) 1890 1978. Agency. Denmark 1914 FTC. Ireland 1978. BFDI. Germany "The Right to Privacy" - 1948 1970. Datainspektionen Sweden 1978. CNIL. France 1980 Privacy Act. AUSTRALIA 1953. EUROPA. Convention for the Protection of Human Rights and Fundamental Freedoms 1974 23 28 1984. ICO. UK DPAS Privacy Act. USA 1988 1996. Personuvernd. Iceland 1988. Agency. Finland Country CEU 1996. ADA. Lithuania 1996. Garante Privacy. Italy 1994. CNPD. 1995 1993. AEPD. Portugal Spain 1992. Agency. Slovakia 1992. CPVP. Belgium 1997. HDPA. Greece Directive 95/46/CE of the European 1998. GIODO. Poland Parliament and of the Council 2000. Commission Decision pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the Safe Harbour privacy principles and related frequently asked questions issued by the US Department of Commerce. 2000. UOOU. Czech Republic Latvia 2001. DVI. 2002. CNPD. Luxembourg 2012. WORLD ECONOMIC FORUM. "Rethinking Personal Data: Strengthening Trust" 2003. ARGENTINA. Ley 25.326 Protección de los Datos Personales 2005. Dsk. Romania 2005. APEC. Privacy Framework 2005. IP. Slovenia 2011. WORLD ECONOMIC FORUM. Whitepaper "Emergence of a new asset class" DPAS and their finances: where does the money come from & is Data Protection a cost? DPAS are public budget financed to cover functioning costs. The ways of allocating this budget varies per country. Some countries also charge fees for registering their data files while others rely more on fines to assure revenue. DPA BUDGET AND POPULATION 25.000.000 20.000.000 70 60 15.000.000 Population 50 Budget 10.000.000 40 5.000.000 30 20 10 Italy Sweden Poland France Hungary Ireland Netherlands Denmark Finland Portugal Slovakia Slovenia Bulgaria Czech Republic Romania Estonia Greece Iceland Malta Louxembourg SOURCES OF FUNDING SPAIN CZECH REPUBLIC 135% -32% 17 % 83 % MAJOR SURPLUS MAJOR DEFICIT Fees and public budget financed Solemnly public budget financed INCOME E € COSTS DISTRIBUTION OF DPAS BUDGETS 9 7 7 Data Protection Agencies are rarely huge money loosing enterprises for European countries, on the contrary! With Spain leading the way, the right equilibrium needs to be found between having a balanced budget, protecting citizens' rights and fostering economic growth through nurtured entrepreneurship. 3 3 Loss-making agencies Balanced Moderate surplus High surplus budget (up to 25%) (over 50%) DPAS and their activities: what is all this money used for & does it defend citizens' rights? DPAS exist to defend citizens' rights to data protection. While sanctions are the most publicized outcomes, their daily tasks revert around consulting, inspecting and following-up on complaints or denunciations -think of the Ombudsman type of profile- while giving recommendations. COUNTRIES WITH MOST CITIZEN COMPLAINTS COUNTRIES DOING THE MOST INSPECTIONS UI UK 13.800 Spain Hungary 5.389 2.929 16.000 500 llui: 12.000 400 Complaints 8.000 300 Inspections 1.350 4.000 200 42 100 UK France Spain Hungary Poland Denmark Belgium France Slovenia Italy Ireland Slovakia Portugal UK Sweden COUNTRIES WITH THE HIGHEST RISK OF SANCTIONS COUNTRIES WITH THE HIGHEST (total sanctions /# of inspections) AVERAGE SANCTIONS (total amount earned by sanctions / # of total sanctions) 55% United Kingdom 135.650 € United Kingdom 21% Netherlands LOWEST LOWER RISK 370 € Netherlands 11% Spain") 38% Italy 75% Romania 200 € Romania 8.800 € Italy 79% 34.000 € Spain 1.700 € Portugal Portugal While the highest average amount of sanctions goes to the UK, the ICO also enjoys the lowest sanctions and inspections compared to citizens complaints. Additionally, countries are also limited in the maximum amount of sanctions they can attribute. A) Metrics and KPI As the data emanating from the annual reports we looked at is so disparate, it rapidly became dangerous to go into further detail. We did want to leave you with some ideas of quantity and amount of sanctions for the last available year for each DPA as well as maximum fines each country is allowed, by law, to hand out. NUMBER OF SANCTIONS PER COUNTRY Spain AMOUNT GAINED BY SANCTIONS PER COUNTRY 700 600 20.000.000 572 500 400 Sanctions 19.500.000 300 200 19.000.000 Spain 100 18.500.000 Slovakia France Spain Italy Bulgaria Hungary Slovenia 18.000.000 Portugal Estonia 19.500.000 € Romania UK Czech Republic 3.120.000 € MAXIMUM Min Max 3.000.000 AMOUNT OF UK 606,642 2.500.000 Spain Czech Republic SANCTIONS 900 600,000 Amount gained by sanctions DPAS CAN 204,000 408,000 2.000.000 HAND OUT Germany 50,000 300,000 1.500.000 € Poland 1.500.000 (in euros) 270,000 Netherlands 250,000 1.000.000 France 150,000 644.000 € Greece 500.000 146,000 Italy 6,000 120,000 Hungary 36,000 Italy Ireland Portugal Portugal UK 250 Spain Bulgaria Romania 30,000 Switzerland France 7,900 Netherlands SANCTIONS IN THE LIGHT OF COMPLAINTS Czech Republic Portugal Italy Spain UK DRA 5.000 10.000 15.000 20.000 25.000 30.000 35.000 40.000 135.000 140.000 Average sanction Portugal Italy Spain € 8,823 € 34,091 € 135,650 € 5,837 € 2,550 UK Average sanction generated by a complaint € 1,690 € 681 > All the amount are in € currency, the currency is in constant value of last october, in order to do the comparison and comprehension of information easier. € 230 TOWARDS HOMOGENIZATION OF FINANCIAL DATA, MORE TRANS PAREN CY & CLOSER COLLABORATION ? The sources of the data used to build this infographic are the latest publicly available annual reports, posted by each DPA on their respective website. Authorities - one for each German länder, a total of 16 - we have decided nof to include one of the major locomotives for Data Protection in Europe. Hopefully, we will be able to include at least Hamburg, Schleswig-Holstein and Berlin in the next iteration. Austria, Croatia, Lithuania and Norway have also been discarded for the time being. It took us 3 months to go through each and every document – ranging from 17 pages for Portugal to over 235 pages for Italy and try to find common data that could then be compared. while enjoying a yearly public budget of almost 15 million euros, the ÆPD, Spain's DPA, made 19.5 million euros in fines in 2011. So, as the European Personal Data Protection Regulation continues to be debated in 2014 to hopefully pass by next year, one has to wonder if financial alignment, transparency as well as closer collaboration between DPAS shouldn't also be a pre- requisite to assure continuous Data Protection for European citizens in an increasingly digitalized world. We have tried to the best of our abilities to draw correct The reason why we started this study is because Spain, the country where Mind Your Privacy is headquartered, is, as the UK's ICO, an outlier within the DPA landscape. conclusions of such disparate sources, while remaining objective. Note that, as Germany has no centralized reporting system of the work undergone by their respective Data Protection It however sits on the opposite spectrum, being responsible for almost 80% of data protection fines in Europe in 2011. Indeed, The data collected can be found by downloading the Excel. We welcome your feedback and wish you a data driven yet protected Data Protection Day 2014! Sources: latest publicly available annual reports, posted by each DPA on their respective website. @MindPrivacy [email protected] Mind Your! Dataset: bit.ly/DataProtectionDayexcel O www.MindYourPrivacy.com SPAIN • GERMANY • UK SCANDINAVIA • NETHERLAN DS Privacy DPAS annual budget (in euros) Spain Latvia Population (in millions) UK Latvia Netherlands