The Annual Privacy Forum 1^st edition

Programme

Wednesday 10/10/2012

Thursday 11/10/2012

Panel 1: The economic dimension of data protection

Chair: Giorgos Rossides, Special Advisor - Data Protection Reform | Cyprus Presidency of the Council of the EU

This panel aims to examine the interaction of the fundamental right to the protection of personal data with the economic imperatives of the 21st century digital internal market. The innovative business models of this market have, in recent years, come to increasingly depend on the utilisation of personal data. While this fact may carry significant advantages in terms of the personalisation and customisation of web-based services, it also brings with it considerable risks for the protection of personal data and calls into question the regulatory regimes that are in place to ensure this protection.

Key questions to be explored:

• What are the changes that have happened since the adoption of the EU data protection regulatory framework in 1995? How do these changes challenge our existing legal framework for the protection of personal data?
• What are the economic trade-offs between the provision of ‘free’ digital services and the uptakes of these services by individuals? Is personal data the currency with which these services are paid for?
• Have technological advances rendered privacy and data protection irrelevant? Do people care?
• What would be the best solutions to ensuring the protection of personal data without stifling innovation and entrepreneurship on the internet?
• Will the proposed EU data protection reform help foster the economic growth, innovation, job creation it envisages, particularly for micro and medium-sized enterprises, in the currently negative economic environment?

Panel Composition:

• Alessandro Acquisti, Carnegie Mellon University

• Melina Violari, Policy and Privacy Manager,Facebook Europe

• Andreas Krisch, president EDRi (European Digital Rights), VIBE!AT

Panel 2: Research Challenges in Privacy 

Chair: Bart Preneel, PC chair APF 2012, professor KU Leuven

The developments at EU level in the policy framework related to privacy represents one of the most interesting and fast evolving sectors in EU policy. At the same time, for a number of years the EU is making a significant investment in collaborative EU funded R&D in the areas of NIS and privacy.

The main purpose of ENISA is to enhance the capability of the Community, the Member States and, as consequence, the business community to prevent, address and respond to network and information security problems. To this end, ENISA has observed that many of the innovations occurring in the programs of EU funded R&D are not feeding to the relevant policy initiatives in the areas of NIS and privacy. In a similar way the strategic priorities of EU policy in the area of privacy are not feeding to research priorities.

The Agency is proposing a panel where experts working in the area of privacy will discuss and address these gaps. With this panel we will cover topics such as ‘privacy by design’ between objective and practice, technical implementation issues for the ‘right to be forgotten’, etc. Furthermore we will try to identify with key experts topics that should receive priorities for funding in the near future in order to address the policy agenda of the EU.

Panel Composition:

• Caspar Bowden, independent expert 
• Kai Rannenberg, professor University of Frankfurt
• Florian Kerschbaum, professor University of Dresden
• Antonio Kung, TRiALOG

Panel 3: European Policies and Technological Innovation in Privacy and Data Protection

Chair: Rosa Barcelo, Policy Coordinator Trust & Security Unit, European Comission - DG CONNECT

Commission - DG CONNECT Privacy is a fundamental need and a basic right in Europe. New information and communication technologies have given it a completely new dimension, for instance in terms of accessibility of personal information online, transparency of the use of data and the availability of personal data in the future. The dynamic uptake of new communication devices and forums online often comes with new challenges and costs for preserving one's individual needs of privacy protection. European policies and research efforts address these challenges, most recently with this year's Commission proposal of a major reform on the protection of personal data. At the same time, R&D results from the scientific communities in Europe outline new approaches for privacy in the digital age.

This panel will discuss how Europe can deliver a regulatory environment for the privacy needs of its citizens that keeps pace with technological developments and stimulates growth and innovation. A question to be raised here would be how regulatory efforts and technological innovation for online privacy can complement each other to ensure the effective protection of citizens’ rights. Another point for discussion would be how policies and research can support a fundamental change from a reactive mode of adapting privacy rules to new online forms of communication to privacy rules applicable for any emerging online environment. European decision-makers of privacy policies will discuss with research and industry representatives as well as the participants of the Forum their views and approaches on these questions.

Panel Composition:

• Nicolas Dubois, Data Protection Unit, Directorate General Justice, European Commission
• Michael Waidner, SIT Research Group, Chair Fraunhofer SIT, Director CASED and EC-SPRIDE
• Peter Schaar, the Federal Commissioner for Data Protection and Freedom of Information (BFDI)
• Gwendal Le Grand, Commission Nationale de l'Informatique et des Libertés (CNIL), Head of IT experts group
• Caspar Bowden, independent expert 
• Giovanni Buttarelli,  Assistant Supervisor, European Data Protection Supervisor (EDPS)

Workshop organized by NESSoS - Privacy By Design and Secure Software Engineering

Chair: Aljosa Pasic, the Chair of Industrial advisory board of the Network of Excellence on Engineering Secure Future Internet Software Services and Systems (NESSoS)

Privacy by Design is a hot topic. Virtually al stakeholders agree that it is better to build in than to bolt it on later, but European security industry expressed concerns[1] about vagueness and ambiguity of this concept. In order to come with a structured process, industry might need to take a look at requirements engineering, formal languages, programming environments and the other areas of engineering secure software-based services. The engineering of secure software services is based on the principle of addressing security concerns from the very beginning in system analysis and design, thus contributing to reduce the amount of system and service vulnerabilities and enabling the systematic treatment of security needs through the engineering process.

This panel aims to examine the interaction of privacy by design and secure software and service engineering.  For example, most current requirements engineering approaches consider security only at the technological level, failing to capture the high-level requirements of trust or privacy. In parallel we are witnessing emergence of Future Internet services and applications. They are composed of several services (created and hosted by various organizations and providers), each with its own security and privacy characteristics. The service compositions are very dynamic in nature, and span multiple trust domains, resulting in a fragmentation of ownership of both services and content, and a complexity of implicit and explicit relations among the participants.

Key questions to be explored:

• What are the best practices for Privacy by Design in practice?
• What impact has service-orientation on privacy by design and on secure software and service engineering?
• How do we combine software engineering and data management sides of (compositional) privacy by design principle?
• What does location privacy means for secure software engineering?
• What solutions or approaches will you foresee to solve the challenges and fill the gaps?

Workshop speakers :

• Jorge Cuellar, Siemens : The need to standardize location privacy protection policies  --  A look at the IETF

• Claire Vishik, Intel : Principles of Privacy by Design in Smartmetering: issues of importance to privacy engineers and technologists. 

• Slim Trabelsi, SAP : Use of USDL-SEC for privacy goals

• Aljosa Pasic, Atos : Model Driven Privacy : does it exist?