ICDPPC 2019 Report now available

Following a successful 41 st ICDPPC conference held in October 2019, in Tirana, a final report of the event is now finalized amidst the delays caused by the COVID-19 pandemic, and we’re pleased to be able to share it with you. The IDP Commissioner’s Office will always remain grateful to all our partner organisations and to each participant at the ICDPPC 2019 conference for the latter’s success.

ICDPPC 2019 report

Dispatch from Albania: ICDPPC calls for increased global cooperation

IAPP Editorial Director Jedidiah Bracy, CIPP, reports on the 41st annual International Conference for Data Protection and Privacy Commissioners

The opening session of the 41st annual International Conference for Data Protection and Privacy Commissioners kicked off in Tirana, Albania, Wednesday. Common talking points throughout the event have included the need for convergence and cooperation, not only among global regulatory authorities, but also among industry, government and civil society as dramatic advances in digital technology continue to challenge laws and regulations, business models and democracies around the world. IAPP Editorial Director Jedidiah Bracy, CIPP, reports on the session, including comments made by ICDPPC President and U.K. Information Commissioner Elizabeth Denham and Republic of Albania Prime Minister Edi Rama.

Read full story at the link below:

https://iapp.org/news/a/dispatch-from-albania-icdppc-calls-for-increased-global-cooperation/

Historic progress towards regulatory cooperation and high data protection standards

“I spoke yesterday about the opportunity we had for this week to go down as one of the most defining of the ICDPPC’s 40 year history. I think we would all agree we’ve achieved that aim.”
Elizabeth Denham CBE, ICDPPC Chair

The 41^st International Conference of Data Protection and Privacy Commissioners (ICDPPC) in Tirana, Albania began with the closed session, where members agreed a framework that continues to strengthen the group’s position as an effective international forum.

Central to that is a policy strategy that sets out a clear vision for this organisation for the next two years. The policy strategy builds on the ICDPPC’s Madrid Declaration and last year’s Roadmap on the Future of the Conference. It is the result of significant international collaboration.

The policy strategy is based on three pillars: evolution toward global frameworks and standards, greater enforcement cooperation and identifying priority policy themes. It confirms three strategic priorities:

• Advancing global privacy in a digital age, confirming a move towards a global regulatory environment;
• Maximising the conference’s voice and influence, notably in enhancing the conference’s role in digital policy and strengthening relationships with other international bodies and networks;
• Capacity building to support members sharing expertise year-round.

The diversity in support for the approach showed a global commitment to action. And the wealth of support in people committing their time and expertise to implementing the approach shows a group that is willing to take action.

The strategy will be reinforced by an outward looking approach to engaging with stakeholders, in particular civil society, in a new reference panel to be formed in 2020.

The policy strategy will be published on the ICDPPC website in due course.

This passion for privacy and data protection was reflected in the resolutions. Passed resolutions were:

• Resolution on the promotion of new and long-term practical instruments and continued legal efforts for effective cooperation in cross-border enforcement;
• Resolution on privacy as a fundamental human right and precondition for exercising other fundamental rights;
• Resolution to support and facilitate regulatory co-operation between data protection authorities and consumer protection and competition authorities to achieve clear and consistently high standards of data protection in the Digital Economy;
• Resolution to address the role of human error in personal data breaches;
• Resolution on social media and violent extremist content online.

The resolutions will be published on the ICDPPC website this week.

The conference opened with a warm welcome in Tirana from Commissioner Besnik Dervishi, Albanian Information and Data Protection Commissioner’s Office, and host authority of this year’s conference.

The following new members were welcomed:

• Chilean Transparency Council, Chile;
• Commission Nationale pour la Protection des Données à Caractère Personnel, Gabon;
• Data Protection Commissioner, OECD;
• Autorità Garante per la protezione dei dati personali, San Marino;
• National Agency for the Protection of Personal Data, Sao Tome and Principe;
• OECD Data Protection Commissioner (without voting rights).

Elizabeth Denham CBE, UK Information Commissioner, was confirmed as ICDPPC chair for a further two years. Marguerite Ouédraogo Bonane, President of the CIL, Burkina Faso was re-elected to the Executive Committee. Eduardo Bertoni, Director of Access to Public Information Agency, Argentina was elected to the Executive Committee.

A detailed session on artificial intelligence, building on last year’s resolution, discussed the technology in the context of international regulation and ethics, followed by a session sharing practical experience from members of running an effective data protection and privacy authority.

The session welcomed contributions from ICDPPC working groups, ICDPPC observers at international organisations and updates from regional, linguistic and topic-specific networks.

The second day included updates from Professor Joseph Cannataci, UN Special Rapporteur on the Right to Privacy, and Professor Colin Bennett, University of Victoria, who discussed his research on privacy and democratic engagement.

There was a presentation looking ahead to the 2020 conference in Mexico, and the announcement of New Zealand as 2021 host.

Closing the closed session, Commissioner Besnik Dervishi said: “As a result of this week, the conference will no longer be the same. I’m happy and excited that Tirana will remain a landmark in the history of the conference.”

Closed Session day two

The second day of the 41st ICDPPC Closed Session kicked off with a presentation from the UN Special Rapporteur on the Right to Privacy, Prof. Joseph Cannataci, and the updates from the regional/linguistic/topic-specific networks.

Please don’t forget to use #41ICDPPC with your posts on your social networks and communication channels.

Rohit Chopra of the US Federal Trade Commission (FTC) about the latest from the United States and international cooperation on data protection enforcement.

As privacy commissioners from around the globe are gathering in Tirana for the the 41st International Conference of Data Protection and Privacy Commissioners (ICDPPC) we hear from Commissioner Rohit Chopra of the US Federal Trade Commission (FTC) about the latest from the United States and international cooperation on data protection enforcement. This interview is conducted by Nelly Stratieva, executive editor of the European Data Protection Law Review (EDPL) – ICDPPC’s main media partner. You can find a PDF version of this interview here: https://lnkd.in/dTTKGeU. Enjoy!

41st ICDPPC is about to kick off tomorrow on 21 October

We are delighted to announce that the 41^st ICDPPC is about to kick off tomorrow on 21 October. There are 700 confirmed delegates expected to attend the Conference in Tirana. The International Conference will also feature over 25 ICDPPC official side events this year. There will be 38 distinguished speakers from all over the world. The Conference will consist of 9 panels (closed and open session) and 9 networking events +  Innovation Nest Festival will be organized during the week. 8 stand will feature at the main venue during the Open Session on 23 and 24 October and many other surprises.

We look very much forward to welcome you to Tirana.

Hong Kong Commissioner Wong: Upcoming EU and Chinese Privacy Laws Will Get the Limelight

The interview tour around the world continues, giving us a taste of the diversity and importance of the issues which will be discussed at the upcoming 41st International Conference of Data Protection and Privacy Commissioners (ICDPPC). Next stop on our tour: Hong Kong.

We speak with Mr Stephen Wong, the Privacy Commissioner for Personal Data and Co-chair of the ICDPPC Working Group on Ethics and Data Protection in Artificial Intelligence. Commissioner Wong believes Hong Kong privacy laws are due an update to keep up with technological trends and to avoid the jurisdiction getting labelled as risky. Hong Kong’s privacy chief expects that the EU ePrivacy Regulation and the new mainland China privacy laws will have a major impact internationally. He echoes the call of his European and Australian colleagues, EDPB Chair Jelinek and Commissioner Falk, for more global convergence to avoid fragmented regional privacy frameworks, and adds the attention to ethics from last year’s ICDPPC should be continued. Nelly Stratieva, editor of the European Data Protection Law Review (EDPL), conducts the interview with Commissioner Stephen Wong.

NS: Commissioner Wong, could you tell our readers more about the current privacy and data protection issues and initiatives in Hong Kong?

SW: With the rapid advance in innovation and technology, and in the wake of the global regulatory tsunami dramatically altering the global privacy regulatory landscape, as well as the increasing number of high-profile data breaches over the last few years, it is high time that Hong Kong conducted a review of its data protection law, the Personal Data (Privacy) Ordinance (PDPO). We want to strengthen public confidence in personal data protection, and to ensure that Hong Kong is not left behind as a ‘risky’ jurisdiction for hosting data.

It is necessary for Hong Kong to have laws that keep up with technological development and international trends. In EDPL INTERVIEW SERIES: COMMISSIONERS AROUND THE WORLD INTERVIEW considering a reform of our personal data privacy law, the Office of the Privacy Commissioner for Personal Data (PCPD) had due regard to all factors and circumstances in balancing the protection of privacy and the free flow of information as well as other freedoms. We keep in consideration that the personal data privacy right is a fundamental human right in Hong Kong guaranteed not only specifically under the PDPO, but also generally under Article 17 of the 1966 United Nations International Covenant on Civil and Political Rights (by which Hong Kong has been abiding since 1976), mirrored in Article 14 of the 1991 Hong Kong Bill of Rights Ordinance (Cap 384, Laws of Hong Kong), and constitutionally under Article 39 of the Basic Law of the Hong Kong Special Administrative Region of the People’s Republic of China.

Regarding the scope of the current PDPO review, the PCPD considers that the following issues are, among others, of high priority: (a) mandatory breach notification, (b) the power to impose administrative sanctions such as monetary penalties, (c) direct regulation of data processors, and (d) the data retention period.

NS: You hosted the 39th ICDPPC in Hong Kong in 2017 where it seemed that the word in everyone’s mouth was the GDPR. What do you think will be the next law that could have a similar disruptive impact internationally? Do you expect it to come again from Europe or from another part of the world?

SW: I believe that when the e-privacy legislation in the EU and the various pieces of legislation on privacy protection in mainland China becoming mature they would be the next in the limelight.

Now that the online world occupies a significant part in our daily lives, what we have in the physical world is increasingly expected to be available in the online world. We have long established laws on various aspects of privacy for the physical world. Likewise, e-privacy is increasingly expected. The GDPR deals with this aspect but only partially. The ePrivacy Regulation intends to regulate not only traditional telecommunications operators, but also ‘Over-the-Top’ communication services (eg, email, instant messaging such as WhatsApp) to ensure that end-users’ confidentiality of communications is protected. The data under protection is not limited to personal data, but also metadata and machine-to-machine communications. The e-privacy legislation will make protection of individuals online more comprehensive.

The mainland of China is catching up in privacy legislation, and is catching up fast, though it does not have one single piece of omnibus legislation covering data protection. The related legislation work is now on the priority list of the National People’s Congress. We believe that the effect of the legislation will be far-reaching given the economic status of China in the globe and the high volume of trade between China and other countries.

In the mainland of China, the Cybersecurity Law imposes, amongst others, a data localisation requirement. Under this requirement, operators of critical information infrastructure (such as public communications and information services, energy and transportation) are restricted from transferring personal information and important data to a place outside the boundary of mainland China.

According to a report by the Wall Street Journal in July 2019, the US and many foreign businesses consider those new draft rules and standards as draconian measures for implementing the Cybersecurity Law and represent additional barriers to the Mainland market. Some foreign businesses think these rules and standards forbid certain data from leaving mainland China or at least slow the process of dispatching data, which would increase uncertainties and costs for business. These are the concerns expressed by the relevant stakeholders.

In the face of these concerns and uncertainties, commitment in the form of pledging and certification under certain robust data governance principles developed by trade practitioners and facilitated by regulators can serve as an alternative means to promote trusted data transfers from the mainland of China.

NS: What major issues do you hope will be addressed at the 41st ICDPPC in Tirana? Which topics are of most importance for you?

SW: As technology becomes increasingly pervasive in our lives, no doubt ethics will become even more important. One of the challenges that regulators have to continue to meet will be how they could help unlock and share personal data within the legal and ethical frameworks in the midst of widely applied sensory ability, cognition, robotics, machine learning, cloud services, etc. We can see that complementing compliance with the law by adopting data ethics will form the bedrock for nurturing and flourishing data protection in times of change.

Ethics and data protection was one of the major items at the 40th ICDPPC in Brussels last year, and we foresee that it would continue to be one in Tirana. The PCPD has advocated data ethics for some time. Now it is high time we pushed forward ‘ethics by design’. As the co-chair of the ICDPPC Working Group on Ethics and Data Protection in Artificial Intelligence, we would continue to contribute via this platform.

Besides data ethics, we believe that international cooperation on enforcement, in particular the possible tools and mechanism to facilitate, would be another key initiative on the global data privacy arena. Given the global nature of data breaches, every data protection authority affected would have to conduct its own investigation, leading to a waste of resources and possibly divergent results. Meanwhile, fragmented regulatory frameworks around the world, in Asia in particular, have been a major concern for organisations having international or interregional operations. There is hence a pressing need for regulators to work together to bring about fair enforcement outcomes, especially in relation to cases involving multinational organisations. In fact there is no justification for regulators not to put their heads together for a de-fragmented regulatory framework, if not a harmonised one. We should explore the possibilities for collaboration among regulators across jurisdictions in the form of an international agreement to deal with cross-border data breaches effectively. It also echoes the theme of the 41st ICDPPC: Convergence and Connectivity.

Discover Albania through this captivating article published on NYT

“The City Poised to Become Europe’s Next Affordable Creative Haven” entitles its recent article on Albania the influential New York Times. We wouldn’t be able to describe Albania better than NYT’s Alexander Lobrano, hence we invite you to read the article at the following link: https://www.nytimes.com/2019/09/06/t-magazine/tirana-albania-travel-guide.html

The 41^st ICDPPC organization team is thankful to the former federal Privacy Commissioner of Canada, Mrs. Jennifer Stoddart, and the IAF’s Marty Abrams for sharing this article with us.  

Don’t forget to register for the upcoming 41^st International Conference of Data Protection and Privacy Commissioners (ICDPPC), to be held in Tirana, from 21-24 October 2019.

The early bird deadline for the 41st ICDPPC Conference has been extended to 20 September 2019.

The annual conference will be held in Tirana, Albania on 21-24 October 2019, and this year’s theme is: ‘Convergence and connectivity: raising global data protection standards in the digital age.’

View the conference’s full programme and register today.

Australian Information and Privacy Commissioner Angelene Falk to Propose Global Policy on Mandatory Notification of Data Breaches

We continue our ongoing interview series ‘Commissioners Around the World’ with a conversation with Angelene Falk, the
Australian Information Commissioner and Privacy Commissioner and Executive Committee member of the International
Conference of Data Protection and Privacy Commissioners (ICDPPC). As we count down to the next annual ICDPPC meeting in
Tirana this October, the Executive Editor of the European Data Protection Law Review (EDPL), Nelly Stratieva, is speaking to
national data protection regulators about the latest from their part of the world and their expectations about international
cooperation.

In this interview, Australian Commissioner Falk discusses her country’s new Consumer Data Right and Digital Platforms
Inquiry, as well as the recently introduced mandatory notification of data breaches. Commissioner Falk points out the need
for greater interoperability between regional frameworks in light of their growing number across the globe. She proposes a
concrete step in that direction – the adoption of a resolution at the upcoming 41st ICDPPC for a global policy on mandatory
notification of data breaches.

NS: Could you tell our readers more about the current privacy and data protection issues and initiatives in Australia?

AF: As Australia’s national privacy regulator, I am involved in a number of initiatives aimed at effectively regulating privacy
in the digital age. One of the key regulatory themes we are pursuing is how to get the right balance between privacy selfmanagement and organisational accountability. We are holding organisations to account and working to support consumers
in making informed decisions about their personal information.

One of the major changes over the coming months will be the new Australian Consumer Data Right, or CDR. This is a data
portability measure intended to create more competition and choice in the market by giving consumers control over how
their data is used and disclosed.

It will allow consumers to access particular data in a readily usable form and direct a business to securely transfer it to
another accredited business. My role is to ensure that strong privacy safeguards are built into the system, so consumers can
benefit from being able to switch service providers while their personal information is protected. We will also resolve
consumer complaints from individuals and small businesses, once the system is operational in February 2020.
Another important area of focus is the way digital platforms are handling personal information. Our competition regulator in
Australia, the Australian Competition and Consumer Commission (ACCC), has just completed an inquiry into the effect that
digital search engines, social media platforms and other digital content aggregation platforms are having on competition in
media and advertising service markets.

The inquiry has also looked at whether existing regulatory frameworks for the collection and use of data remain effective in
addressing the challenges of digitisation and the world of targeted advertising. We have been collaborating with the ACCC to
consider ways to strengthen data protection outcomes for Australians, and this process has recommended reforms to our
privacy laws to ensure that our framework is meeting the evolving challenges we face in this digital environment.
In both these areas — the Consumer Data Right and the Digital Platforms Inquiry — we have been working closely with the
Australian competition regulator. This collaboration between data protection and consumer protection authorities is an
essential part of protecting consumers in the digital age. This was also recognised by the ICDPPC’s 39th conference, in Hong
Kong in 2017, when it adopted a resolution on collaboration between data protection authorities and consumer protection
authorities for better protection of citizens and consumers in the digital economy.

In 2018, Australia introduced mandatory notification of data breaches to affected consumers and the privacy regulator. This
means that where someone’s privacy has been breached, and they are at risk of serious harm, they are informed of that
breach and are able to take the necessary steps to protect their personal information. Our regulatory focus during the first
year of the Notifiable Data Breaches scheme has been on driving awareness of entities’ obligations and of the causes of
data breaches to support better practices. Many entities have taken a proactive approach to engaging with us, allowing us
to work constructively with them to ensure an effective response. To date, we have clearly seen how the scheme is
increasing transparency and accountability for personal information handling practices.

Mandatory notification of data breaches is a feature of many data protection frameworks around the globe, and I will be
presenting a proposed resolution in Tirana that contributes to a global ICDPPC policy on this issue, with the goal of
preventing personal data breaches through security safeguards that target the ‘human factor’.

NS: The GDPR resounded around Europe and the world. In your opinion, what will be the next legislative frontier that
could have such disruptive power?

AF: The GDPR has had a big impact on information handling around the world, and it continues to influence data protection
legislation in other jurisdictions.
In today’s digital age we need our legal frameworks to reflect technological developments so they remain fit for purpose. I
expect we will continue to see legislative changes in the years to come. To succeed, they will need to provide for greater
interoperability between regional frameworks.

Interoperability doesn’t mean uniformity, but instead recognises the differences in our frameworks and provides a bridge to
ensure that personal information is protected no matter where it flows. As regulators, we can work towards this by
collaborating on developing policy positions, guidance, tools and enforcement.

These efforts are already reflected in the standards we are seeing emerge around the world: the GDPR, Convention 108, the
Ibero American Data Protection Standards, APEC Cross Border Privacy Rules (CBPR) and the OECD Privacy Guidelines.
International data transfers can also be facilitated through other regulatory tools such as certification and privacy seals,
codes of conduct, binding corporate rules and standard contractual clauses, to name a few.
Building on this, we are considering the role a certification scheme could play in Australia as a way for organisations to
demonstrate their accountability in personal information handling. We are looking at what’s been done on this already in
jurisdictions like the EU, Japan, and Singapore.

We are also implementing the APEC Cross Border Privacy Rules in Australia, which my office will enforce. In doing this we can
learn from others further down the CBPR road, like the US, Japan and Singapore, where this mechanism is in place to provide
accountable cross-border data transfers.
As a regulator, my ability to efficiently prevent, detect, deter and remedy relies on cooperation and collaboration, and a
framework that is interoperable with other regions.

NS: What major issues do you hope will be addressed at the 41st ICDPPC in Tirana? Which topics are of most
importance for you?

AF: The themes of this year’s conference — convergence and connectivity — could not be more relevant in 2019. Around the
world we are seeing data protection laws intersect with consumer protection, human rights and the digital economy.
This convergence underlines the importance of collaboration between privacy regulators. Collaboration between data
protection authorities and consumer protection authorities is also an essential part of protecting consumers in the digital
economy. In Australia, this is borne out in our work with the Australian Competition and Consumer Commission on a range of
initiatives including the Australian Consumer Data Right and an inquiry into digital platforms. My office also co-chairs the
ICDPPC’s Digital Citizen and Consumer Working Group with the Office of the Privacy Commissioner of Canada.
Accountability is the other important topic I see at this year’s conference. The interrelationship between privacy selfmanagement and organisational accountability is crucial to raising global data protection standards in the digital age. Done
well, privacy self-management allows individuals to exercise choice and control by understanding how their personal
information is being handled. But it’s reliant on organisations making this information accessible and understandable, and
we must continue our focus in this regard.