[Music]
good morning everybody it's a real
pleasure and let me say a privilege to
be here with you after such a long night
and unexpected two year break the word
looks a lot different than it did in
November two years ago in ways which
none of us would have predicted few of
us would have predicted such a deadly
resurgence of terrorists in the hurt of
Europe that would have disrupted
everyday life in Belgium France and
other countries including of course the
cancellation of the last year's I EPP
Congress and few of us would have
predicted a consultative referendum in
the UK voting to leave the European
Union none of us would have predicted
such a colorful u.s. presidential
election so we may expect a new chapter
internationally speaking novelties we
will see to which stand there will also
be relevant for privacy and data
protection we might have predicted that
at long last d you would reach agreement
on the new data protection framework my
message to you today is short and simple
get ready for the GDP are but continue
to expect the unexpected it is already
six months since the GDP are and the
police and judicial activities directive
became EU lo there are now 18 months to
go before they become fully applicable
in May 2018 that is 533 days to be fully
compliant with 1999 articles of the reg
and for the directive on police and
judicial activities which is extremely
relevant in terms of prevention
investigation detection and prosecution
of criminal offences member states have
a little bit less time to fully
transpose international law the deadline
as i know is 60 may 2018 2018 and this
is a 3 million relevant for business
companies as well so the ball has been
dispatched by the legislators and now
it's firmly in the court of independent
regulators like us on the incoming panel
so our big challenge is to help
controllers to ensure that the abstract
letter of the law becomes a concrete
reality on the ground I said 99 articles
in 533 days make no mistake the GDP are
is here to stay for a long long time we
need to focus on what is desirable as
well as necessary but the perfect should
not be the enemy of the good my
institution the European data protection
supervisor was never a party to the
negotiations to or on the legislation
were we where as well as all other
independent data protection authorities
in the indie you fully engaged in
fulfilling our advisory role to the
college's letter and I think we were all
able to leverage our years of experience
as advisors to identify ways to improve
the text to focus more on safeguards for
individual and less on bureaucratic
procedures and you might recall that we
as the DPS we produce an app free to
download so that anyone can now more
easily compare the old directive and the
new
regulation one of our big priorities was
to make data protection simple and I'm
pleased to see that we were successful
to some extent 21 provisions for
implementing or delegated acts by the
European Commission we're replaced to
allow independent data protection
authorities to consider targeted and
relevant guidance for controllers and
processes and in the article 29 working
party as said by Isabel we we have the
unique opportunity now to prepare the
future to start developing a new gold
standard for forward-looking and
practical guidelines to be formalized by
the EDB be at the right moment so we
need to be ready for day one the outcome
needs to be user-friendly and draw from
best practices across the you and also
outside d you so the process needs to
consult to be accessible and transparent
with stakeholders as you know this is
also now an obligation under the GDP our
article 70 point for our independence as
DPAs is precious and its value in in
this volatile age of big data mass
surveillance cannot be overstated we
have now extensive case low setting out
the requirements for functional and
visible independence from the executive
other rulings may be expected but
independence is not isolation no DPA
seeds in an ivory tower nor should they
we need to be convergent more conversant
with technology in order to better
assess the impact on personal data
processing and fundamental rights but we
also need to be conversant with
technology to enable more efficient and
inclusive discussions among ourselves as
a community of DPAs and we stakeholders
in this room and elsewhere we need to be
open
we need to establish a new normal for
discussion and debate with controllers
on the basis of accountability
accountability contains the notion that
failure to comply causing arms to
individual with irresponsible data
processing must be addressed and the GDP
are gives us the ability to apply this
onesie proportionate sanctions they must
be scalable of course just like the
obligations throughout the GDP are in
accordance with the riskiness of
processing operation we have discussed
together with colleagues for example how
to set the dial between core activities
and large-scale processing and how this
should influence whether a DPO should be
appointed and how to assist small and
medium enterprises who may not have the
resources to employ a dedicated dbo we
have been discussing the new rights to
data portability and the sectors in
which it would be relevant its
relationship with the consumer and
competition law we have also discussed
how to roll out data protection impact
assessment the types of risky processing
operation which would require one and we
have discussed also the role of
certification a really important
innovation in the GDP are for
accountable data controllers and for
rebuilding trust among individuals in
the area of deeper hyper-connectivity we
need to clarify the roles and
responsibilities of the various players
in this new arena in new including of
course dps the Commission and accredited
certifying bodies so the systems need to
be affordable more than everything this
system must be credible and people are
entitled to expect an acceptable
standard or protection and respect for
companies and governments handling their
personal data as they would expect from
someone handling your private property
or for handling
chains or using medicine this is an
uncertain period for society and an
economy Nassim Taleb in his 2007 book
Black Swan rights eloquently eloquently
how in predicting the future we tend to
ignore isolated events and negative
results and I think we ignore how people
are driven by infinity of instincts then
most of our history is silent and not
documented the European data protection
supervisor ethics advisory group is
working intensively on a set of
principles which one day can help
policymakers and even DPAs to to
navigate existential waters on what it
means to be human in an age of virtual
and enhanced reality and artificial
intelligence what it means dignity in
the 21st century so new ethical
questions are emerging all around us and
everyone is talking about the netflix
Sirius Black Mirror and its kaleidoscope
of technological list appears and one
episode your online reputation literally
determines the ability of people to
participate in society and economy at
any level it may seem ridiculous we know
the recent history of a UK insurance
company wanting to make use of social
media data in determining what policies
to offer to clients and we know about
the Social Credit initiative in China so
I think we have to build on the
technical and the legal framework which
is in place to shape technology and
revenue models it should not be other
way around so that is in gentlemen we
will probably come to gregs eat blacks
in discussion during the following panel
but even if one country will leave the
European Union it
doesn't mean it doesn't change in terms
of globalization there is a movement
against international flows and common
standards we see some tendencies around
the world about protectionism and and
therefore we must meet these challenges
on the basis of that data flows subject
to appropriate rules are also relevant
in terms of benefits to society and
individuals but respect for different
legal culture requires reciprocity
adequacy in the U is not in position and
data protection is not a trade Maria I
think there are opportunities for all to
build bridges and to learn from one
another thank you very much for your and
passion and I wish you and a successful
day