Search

Why is Big Data absent in the recent basic data protection documents of the European Union (EU) and the Council of Europe (CoE)? Why not one single reference to Big Data practices - be it to regulate or to prohibit it - in the recent General Data Protection Regulation (EU) 2016/679, the Data Protection Law Enforcement Directive (EU) 2016/680 and the Modernised CoE Convention 108 for the Protection of Individuals with Regard to the Processing of Personal Data (Convention 108+)? Some actors in the policy field considered Big Data too dan- gerous and counted on existing data protection principles to tame the beast. Others simply ignored the phenomenon or were not aware of the potential benefits of Big Data for economy and governments (the rendez-vous was missed). Our discussion of no less than six recent initiatives, - standalone laws and soft law instruments - is an indication that Europe is embracing Big Data but is seemingly hesitant to confront Big Data within the classical paradigm (field) of data protection law. Concrete guidance for Big Data practices is now spread over multiple texts emanating outside the data protection field.

The Law Enforcement Directive (EU) 2016/680 (LED) defines its basic principles, such as purpose limitation and data minimisation, differently than the General Data Protection Regulation (EU) 2016/679 (GDPR). This contribution is exploring the influence of those differences on new policing methods, in particular on the big data policing. After describing the data protection regulatory framework for law enforcement authorities in the EU, we explain our understanding of the notion of big data policing. We then critically interpret the purpose limitation and the data minimisation principle in the GDPR and the LED, thereby busting some myths about the LED, created by other academics. Finally, we explore the boundaries of the abovementioned basic LED principles, in an attempt to measure their success in finding the delicate balance between the high level of personal data protection and the contemporary law enforcement needs.Keywords: data protection, Law Enforcement Directive, criminal justice, big data, purpose limitation, data minimization

This article provides a critical analysis of the Council of Europe Cybercrime Convention Committee's Guidance Note of Production Orders, published on 1 March 2017. The article looks at the legal controversies surrounding production orders with a cross-border element. It explains the Guidance Note's background and origins, the basic provisions in the Cybercrime Convention allowing the law enforcement authorities to order and obtain certain information and discusses the requirements that follow from the relevant provisions of the Convention. This analysis is complemented by four critical remarks on the way the Guidance Note pushes the boundaries of acceptable treaty interpretation on the necessity of the Guidance Note, its position in regard to extraterritorial enforcement jurisdiction and sovereignty, its reticence towards fundamental rights and its refusal to define or clarify the important notion of “subscriber information”. The article argues that unilateralism is not a solution. Instead of soft law plumbing, what is needed is an agreement between sovereign states checked by their constituencies.

In this chapter, we focus on the role of supervisory authorities monitoring police and criminal justice authorities. This issue raises delicate questions, as the EU legislator was called upon to strike the right balance between diverse interests. In today’s context, no one can deny the importance of access and storage of data, as well as of cross-border data exchanges by police and judicial authorities for the prevention of and the fight against crime. However, no one can deny either the importance of respecting fundamental rights and data protection rules, when collecting, storing, and exchanging personal data. The role of these supervisory authorities constitutes an essential tool to ensure that an appropriate balance is taken and implemented by national police and criminal justice authorities; hence the sensitivity and interest of addressing this issue. After providing a birds-eye view of the EU data protection law in section II, we will briefly explain the basic role of supervisory authorities in section III. Section IV will focus on the requirements for independence of supervisory authorities. In section V, we will look at the competence of such authorities in the supervision of judges and prosecutors. Section VI analyses the powers of supervisory authorities in the criminal justice sector. Section VII provides some practical details on handling complaints and modes of cooperation of supervisory authori- ties. Our concluding remarks are presented in section VIII.