Personal Data Protection and Safeguarding Draft Act ● June 2019 Finally, the principle of security states that reasonable and appropriate technical and organisational safeguards are in place to prevent unauthorised disclosure or breach of data. These principles were adopted by the UN General Assembly in 1990 in a Resolution on guidelines for the data protection of personal information held in computer databases.9 The Guidelines set out 6 basic principles of data protection based on fair information practices, namely the principles of lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination and security. The right of privacy has also been further elaborated by the appointment by the UN Human Rights Council of a Special Rapporteur on the right to privacy10 in the summer of 2015, and the adoption on 18 December 2013,11 21 January 2014,12 and 19 December 201613 by the UN General Assembly and by the Human Rights Council on 22 March 201714 of resolutions on “the right to privacy in the digital age” as well as the recent Report of the United Nations High Commissioner for Human Rights.15 The General Assembly in the latter resolution noted that “the increasing capabilities of business enterprises to collect, process and use personal data can pose a risk to the enjoyment of the right to privacy in the digital age” and called States to: “To develop or maintain and implement adequate legislation, with effective sanctions and remedies, that protects individuals against violations and abuses of the right to privacy, namely through the unlawful and arbitrary collection, processing, retention or use of personal data by individuals, governments, business enterprises and private organisations”.16 2. Data Protection in Europe and Elsewhere Europe is the only region where there is an explicit binding provision enshrining the right to data protection at a regional level, found in in the Charter of the Fundamental Rights of the European Union (CFREU).17 The CFREU has acquired the same “constitutional” level as the founding treaties since the entry into force of the Treaty of Lisbon in 2009.18 Article 8 of the CFREU not only affirms the right to personal data protection, but also spells out the core values associated with this right. It provides that the processing of personal data must be fair, for specified purposes, and based on either the consent of the person concerned or a legitimate basis laid down by law. Individuals must have the right to access their personal data and to have it rectified, and compliance with this right must be subject to control by an independent authority. The EU General Data Protection Regulation (GDPR)19 further specifies that the consent of the data subject shall be free, specific, informed, and unambiguous as a condition for lawful processing. It emphasises the principle of data minimisation Guidelines for the Regulation of Computerized Personal Data Files, G.A. res. 45/95, 14 December 1990, http://www.un.org/documents/ga/res/45/a45r095.htm. 9 10 See OHCHR website, Special Rapporteur on the right to privacy: https://www.ohchr.org/en/issues/privacy/sr/pages/srprivacyindex.aspx. The right to privacy in the digital age, G.A. res. 68/167, 18 December 2013, http://www.un.org/ga/search/view_doc.asp?symbol=A/RES/68/167. 11 The right to privacy in the digital age, G.A. res. 27/37, 21 January 2014, https://www.ohchr.org/documents/issues/digitalage/a-hrc-2737_en.doc. 12 The right to privacy in the digital age, G.A. res. 71/199, 19 December 2016, https://www.un.org/en/ga/search/view_doc.asp?symbol=A/RES/71/199. 13 The right to privacy in the digital age, HRC res. 34/L.7, 22 March 2017, https://documents-ddsny.un.org/doc/UNDOC/LTD/G17/073/06/PDF/G1707306.pdf?OpenElement. 14 The right to privacy in the digital age, Report of the United Nations High Commissioner for Human Rights, HRC res. 39/29, 3 August 2018, https://documents-dds-ny.un.org/doc/UNDOC/GEN/G18/239/58/PDF/G1823958.pdf?OpenElement. 15 16 The right to privacy in the digital age, G.A. res. 71/199, 19 December 2016. European Union, Charter of Fundamental Rights of the European Union, 26 October 2012, 2012/C 326/02, available at: https://eurlex.europa.eu/legal-content/EN/TXT/?uri=celex:12012P/TXT. 17 18 Charter of Fundamental Rights of the European Union, Art. 8. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN. 19 ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 9 of 58