If you thought that 2013 was a big year for privacy, then prepare yourself: it was only the beginning. Many of the privacy stories whose winding narratives began in 2013 will continue to take unexpected twists and turns throughout 2014, with several poised to reach dramatic conclusions – or otherwise spawn spin-offs and sequels.
Here are just a few of the stories likely to dominate the privacy headlines in 2014:
1. EU data protection reform: The Commission's draft General Data Protection Regulation arrived with a bang in January 2012, proposing fines of up to 2% of global turnover for data protection breaches, a 24-hour data breach notification regime, and a controversial new right for individuals to have their data "forgotten" from the Internet, among many other things. Heated debate about the pros and cons of these reforms continued into 2013, with the European Parliament's LIBE Committee only voting on and publishing its position on the draft Regulation in October 2013 (missing two earlier deadlines). All eyes then turned to the Council, expecting it to put forward its position on the draft Regulation sometime in December, only to discover that it had gotten hung up on the "one stop shop" principle and made little real progress at all. With the original goal being to adopt the new Regulation before the European Parliamentary elections in May 2014, a real question mark now hangs over whether Europe will achieve this deadline – and what will happen if it doesn't.
2. NSA surveillance: The biggest privacy story – if not the biggest news story – of 2013 concerned the leaks of classified documents from the US National Security Agency by its contractor, Edward Snowden. The leaks revealed that the NSA had been collecting Internet users' metadata from the servers of leading technology companies and from the cables that carry our Internet communications around the world. This story has had a profound effect in terms of raising individuals' privacy awareness worldwide, impacting global political and trade relationships, and adding impetus to the European Union's regulatory reform agenda. With the Guardian newspaper recently declaring that it has so far revealed only about 1% of the materials Edward Snowden has disclosed to it – and British television broadcasting an "alternative" Christmas message from Edward Snowden on "Why privacy matters" – it's safe to say that this is a story that will continue to headline throughout 2014, prompting the global privacy community to contemplate perhaps the most fundamental privacy question of all: to what extent, if at all, will we trade personal privacy in the interests of global security?
3. Safe harbor: Regulators across several European territories have, for many years now, been grumbling about the "adequacy" of the EU/US safe harbor regime as a basis for exporting data from the European Union to the US. The Snowden revelations have further fuelled this fire, ultimately leading to the European Commission publishing a set of 13 recommendations for restoring trust in safe harbor. The Commission has set the US Department of Commerce an ambitious deadline of summer 2014 to address these recommendations – and raised the "nuclear" prospect that it may even suspend safe harbor if this does not happen. With some 3,000+ US companies currently relying on safe harbor for their EU data exports, many US-led corporations will be watching this story very closely – and would be well-advised to begin contingency planning now...
4. New technologies: Ever-evolving technologies will continue to challenge traditional notions of data privacy throughout 2014. In the past year alone, Big Data has bumped heads with the concepts of purpose limitation and data minimisation, the Internet of Things has highlighted the shortcomings of user consent in an everything-connected world, and the exponential growth of cloud technologies continue to demonstrate the absurdity of extra-EEA data export restrictions and their attendant solutions (Do model clauses really provide adequate protection? Tsch.) Quite aside from the issues presented by technologies like Google Glass and iPhone fingerprint recognition, who can say what other new devices, platforms and services we'll see in 2014 – and how these will challenge the global privacy community to get creative and adapt accordingly.
5. Global interoperability: As at year end, there are close to 100 countries with data protection laws on their statute books, with new privacy laws either coming into effect or getting adopted in countries like Mexico, Australia and South Africa throughout 2013. And there are still many more countries with data privacy bills under discussion or with new laws coming into effect throughout 2014 (Singapore being one example). Legislators around the world are waking up to the need to adopt new statutory frameworks (or to reform existing ones) to respect individuals' privacy – both in the interests of protecting their citizens but also, with the digital economy becoming ever more important, in order not to lose out to businesses looking for 'safe' countries to house their data processing operations. All these new laws will continue to raise challenges in terms of global interoperability – how does an organization spread across multiple international territories comply with its manifold, and often varied, legal obligations while at the same time adopting globally consistent data protection policies, managed with limited internal resources?
6. Coordinated enforcement: In 2013, we've seen the first real example of cross-border privacy enforcement, with six data protection authorities (led by the CNIL) taking coordinated enforcement action against Google over the launch over its consolidated privacy policy across its various service lines. With the limitations of national deterrents for data privacy breaches that exist for regulators in many territories (some cannot impose fines, while others can impose only limited fines) and continuing discussion about the need for "one stop shop" enforcement under the proposed General Data Protection Regulation, it seems likely that we'll see more cooperation and coordinated enforcement by data protection authorities in 2014 and beyond.
2013 was undoubtedly an exciting year for data privacy, but 2014 promises so much more. It won't be enough for the privacy community just to know the law – we must each of us become privacy strategists if we are to do proper justice to protect the business and consumer stakeholders we represent. We have exciting times ahead.
Happy New Year everyone!
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
