Abstract
The principle of accountability has been enjoying growing popularity over the last few years as a way to mitigate the loss of control by individuals over their personal data. It is however unclear whether accountability can be characterised precisely enough to yield effective protection and whether it bears the capacity for innovative solutions. Reasons to support accountability and criticism raised against it are discussed. Analysing accountability critically requires distinguishing between its application levels: we focus on the requirement for data controllers to provide a statement relating their actual data handling operations with their obligations, and put forward a combination of precise legal requirements and effective tools to support strong accountability. After presenting such an approach, called accountability by design, we explore the integration of this framework with legal and economic settings and discuss its complementarity with other instruments for privacy.
This work has been partially funded by the European FI-WARE project/ FP7-2012-ICT-FI. See http://www.fi-ware.eu/.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
- 2.
Note however that the FIPPs have been used as a basis for the US Privacy Act of 1974.
- 3.
The fifth principle, Enforcement/Redress, states that “ (…) the core principles of privacy protection can only be effective if there is a mechanism in place to enforce them”.
- 4.
Notably the fact that PIPEDA “used the OECD Guidelines as a starting point” while “moving the Accountability Principle to the beginning”.
- 5.
Role of accountability, p. 52.
- 6.
In addition, provincial private sector privacy laws exist in Alberta, British Columbia and Quebec. The principle of accountability also appears in those provincial regulations, although in an implicit form.
- 7.
Generally speaking, as pointed out by Colin Bennett (2012), a number of countries engaging in APEC have no national data protection regulation, which makes the existence of this framework all the more important.
- 8.
Article 20.
- 9.
They however emphasise that too strict regulations would be a burden and an unacceptable cost for budding companies.
- 10.
See the project website: http://pats-project.eu/.
- 11.
Those characteristics are defined as follows: completeness means that all agreement violations lead to reports and supporting evidence; accuracy signifies that no violation reports are created if nothing went wrong; and verifiability means that evidence is checkable independently.
- 12.
Definitions of the roles of all stakeholders, their respective commitments, the accounts, the audit procedures, sanctions, etc.
- 13.
As stated in the Article 29 Data Protection Working Party Opinion 3/2010 on the principle of accountability (Article 29 Working Party 2010): “Firstly, we are witnessing a so-called ’data deluge’ effect, where the amount of personal data that exists, is processed and is further transferred continues to grow. Both technological developments, i.e. the growth of information and communication systems, and the increasing capability for individuals to use and interact with technologies favour this phenomenon. As more data is available and travels across the globe, the risks of data breaches also increase.”
- 14.
In the survey Privacy Notices Research by the Privacy Leadership Initiative, only 3 % of respondents declared to “carefully read” privacy notices “most of the time”.
- 15.
The sheer length of this type of document and their convoluted language often prevents users from finding straightforward answers to simple questions such as a promise not to share personal data with third parties or, in case of share, the precise list of third parties which can receive the data.
- 16.
Section 3.4.4.1.
- 17.
Even though this suggestion is not exactly the definition adopted by the Working Party 29 in the rest of the document.
- 18.
§ 1. The controller shall adopt policies and implement appropriate measures to ensure and be able to demonstrate that the processing of personal data is performed in compliance with this Regulation. § 2. The measures provided for in paragraph 1 shall in particular include: (a) keeping the documentation pursuant to Article 28; (b) implementing the data security requirements laid down in Article 30; (c) performing a data protection impact assessment pursuant to Article 33; (d) complying with the requirements for prior authorisation or prior consultation of the supervisory authority pursuant to Article 34(1) and (2); (e) designating a data protection officer pursuant to Article 35(1). § 3. The controller shall implement mechanisms to ensure the verification of the effectiveness of the measures referred to in paragraphs 1 and 2. If proportionate, this verification shall be carried out by independent internal or external auditors.
- 19.
Article 35 § 1: The controller and the processor shall designate a data protection officer in any case where: (a) the processing is carried out by a public authority or body; or (b) the processing is carried out by an enterprise employing 250 persons or more; or (c) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects.
- 20.
Article 28. § 2 : The documentation shall contain at least the following information: (a) the name and contact details of the controller, or any joint controller or processor, and of the representative, if any; (b) the name and contact details of the data protection officer, if any; (c) the purposes of the processing, including the legitimate interests pursued by the controller where the processing is based on point (f) of Article 6(1); (d) a description of categories of data subjects and of the categories of personal data relating to them; (e) the recipients or categories of recipients of the personal data, including the controllers to whom personal data are disclosed for the legitimate interest pursued by them; (f) where applicable, transfers of data to a third country or an international organisation, including the identification of that third country or international organisation and, in case of transfers referred to in point (h) of Article 44(1), the documentation of appropriate safeguards; (g) a general indication of the time limits for erasure of the different categories of data; (h) the description of the mechanisms referred to in Article 22(3).
- 21.
XACML deals with access control.
- 22.
PPL (PrimeLife Policy Language), based on XACML for its access control aspect, also includes many usage control features. It was developed by SAP (Trabelsi et al. 2011) as part of PrimeLife, a 36 month long European project with the goal of investigating “…how to protect privacy in emerging Internet applications such as collaborative scenarios and virtual communities”.
- 23.
For example if its source code is available or can be checked by an independent third party.
- 24.
The a posteriori compliance checking approach is not tied to any particular privacy policy language, but we present the specific example of PPL to give a clearer idea of how the strategy can look like concretely.
- 25.
Sticky policies have also been used in the field of digital rights management; however, they play a very different role in our context because here they are checked a posteriori (rather than on the fly) and the process is audited by third parties.
- 26.
Such as the use of personal data for a specific purpose, its forwarding to a third party, its access by the subject, etc.
- 27.
Anonymisation is technically realized through cryptography.
- 28.
Referring to the breaking of glass to trigger an alarm.
- 29.
Common examples include the exceptional access to medical records in life-threatening situations, credit card fraud scenarios and military information classification systems (Feigenbaum et al. 2011).
- 30.
“Privacy audits have been around for a long time, but there is little evidence that market pressure alone will push this kind of external conformity assessment around the international economy”.
- 31.
“Technology neutrality has long been held up as a guiding principle for the proper regulation of technology, particularly the information and communications technologies” (Reed 2007).
- 32.
To this respect, it would be advisable to introduce accountability as a new requirement of Information Security Management Systems (ISMS).
- 33.
- 34.
Article 26 (2).
- 35.
See for example EuroPriSe, the European privacy seal: https://www.european-privacy-seal.eu.
References
Alhadeff, Joseph, Brendan Van Alsenoy, and Jos Dumortier. 2011. The accountability principle in data protection regulation: Origin, development and future directions. Paper presented at privacy and accountability, Berlin, Germany, April 5--6, 2011.
Article 29 Data Protection Working Party. 2003. Working document on transfers of personal data to third countries: Applying article 26 (2) of the EU Data Protection Directive to Binding Corporate Rules for International Data Transfers. http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2003/wp74_en.pdf. Accessed 28 Feb 2013.
Article 29 Data Protection Working Party. 2010. Opinion 3/2010 on the principle of accountability.http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2010/wp173_en.pdf. Accessed 28 Feb 2013.
Asia-Pacific Economic Cooperation, Electronic Commerce Steering Group (ECSG). 2004. APEC Privacy Framework. http://www.apec.org/Groups/Committee-on-Trade-and-Investment/~/media/Files/Groups/ECSG/05_ecsg_privacyframewk.ashx. Accessed 28 Feb 2013.
Asia-Pacific Economic Cooperation, Electronic Commerce Steering Group (ECSG). 2009. APEC data privacy pathfinder projects implementation work plan—revised. http://aimp.apec.org/Documents/2009/ECSG/SEM1/09_ecsg_sem1_027.doc. Accessed 28 Feb 2013.
Bella, Giampaolo, and Lawrence C. Paulson. 2006. Accountability protocols: Formalized and verified. ACM Transactions on Information and System Security 9:138–161.
Bellare, Mihir, and Bennet Yee. 1997. Forward integrity for secure audit logs. Technical Report CS98-580, Department of Computer Science and Engineering, University of California at San Diego.
Bennett, Colin. 2012. The accountability approach to privacy and data protection: Assumptions and caveats. In Managing privacy through accountability, ed. Daniel Guagnin et al., 33–48. Basingstoke: Palgrave Macmillan.
Butin, Denis, Marcos Chicote, and Daniel Le Métayer. 2013. Log design for accountability. Proceedings of the 4th international workshop on data usage management. Washington, D.C.: IEEE Computer Society.
Canadian Standards Association. 1996. Model code for the protection of personal information (Q830-96). Mississauga: CSA.
Cavoukian, Ann. 2012. Privacy by design [Leading edge]. IEEE Technology and Society Magazine 31:18–19.
Cederquist, JG, Ricardo Corin, M. A. C. Dekker, Sandro Etalle, and J. I. den Hartog. 2005. An audit logic for accountability. Proceedings of the 6th international workshop on policies for distributed systems and networks. Washington, D.C.: IEEE Computer Society.
Centre for Information Policy Leadership. 2009a. Global discussion on the commonly-accepted elements of privacy accountability. http://www.huntonfiles.com/files/webupload/CIPL_Galway_Conference_Summary.pdf. Accessed 28 Feb 2013.
Centre for Information Policy Leadership. 2009b. Data protection accountability: The essential elements.http://www.huntonfiles.com/files/webupload/CIPL_Galway_Accountability_Paper.pdf . Accessed 28 Feb 2013.
Centre for Information Policy Leadership. 2010. Demonstrating and measuring accountability: A discussion document.http://www.huntonfiles.com/files/webupload/CIPL_Accountability_Phase_II_Paris_Project.PDF . Accessed 28 Feb 2013.
Commission Nationale Informatique et Libertés (CNIL), Label CNIL procédures d’audit de traitements. 2011. http://www.cnil.fr/la-cnil/labels-cnil/procedures-daudit/. Accessed 28 Feb 2013.
Common Criteria for Information Technology Security Evaluation. 2013. http://www.commoncriteriaportal.org/cc/. Accessed 28 Feb 2013.
De Hert, Paul. 2012. Accountability and system responsibility: New concepts in data protection law and human rights law. In Managing privacy through accountability, ed. Daniel Guagnin et al., 193–232. Basingstoke: Palgrave Macmillan.
Ernst & Young. 2012. Privacy trends 2012. The case for growing accountability.
European Commission. 2012. Proposal for a regulation of the European parliament and of the council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (general data protection regulation). Brussels: European Commission.
European Parliament and the Council of the European Union. 1995. Directive 95/46/EC of the European parliament and of the council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Brussels: European Parliament.
Feigenbaum, Joan, James Hendler, Aaron Jaggard, Daniel Weitzner, and Rebecca Wright. 2011. Accountability and deterrence in online life. Paper presented at ACM Web Science Conference 2011, Koblenz, Germany, June 14--17, 2011.
Guagnin, Daniel et al., ed. 2012. Managing privacy through accountability. Basingstoke: Palgrave Macmillan.
Haeberlen, Andreas. 2009. A case for the accountable cloud. Proceedings of the 3rd ACM SIGOPS international workshop on large-scale distributed systems and middleware. New York: ACM.
IBM. 2003. The enterprise privacy authorization language (EPAL). http://www.zurich.ibm.com/security/enterprise-privacy/epal/. Accessed 28 Feb 2013.
Jagadeesan, Radha, Alan Jeffrey, Corin Pitcher, and James Riely. 2009. Towards a theory of accountability and audit. Proceedings of the 14th European conference on Research in computer security. Berlin: Springer.
Joint NEMA/COCIR/JIRA Security and Privacy Committee (SPC). 2004. Break-glass: An approach to granting emergency access to healthcare systems.
Karjoth, Günter, Matthias Schunter, and Michael Waidner. 2002. Platform for enterprise privacy practices: Privacy-enabled management of customer data. Proceedings of the 2nd workshop on privacy enhancing technologies. Berlin: Springer.
Lazouski, Aliaksandr, Fabio Martinelli, and Paolo Mori. 2010. Usage control in computer security: A survey. Computer Science Review 4:81–99.
Le Métayer, Daniel. 2009. A formal privacy management framework. Proceedings of formal aspects in security and trust. Berlin: Springer.
Marx, Gary. 2012. Privacy is not quite like the weather. In privacy impact assessment, ed. David Wright and Paul De Hert. Berlin: Springer.
Organisation for Economic Cooperation and Development. 1980. Guidelines on the protection of privacy and transborder flows of personal data.
Organisation for Economic Cooperation and Development. 2011. Thirty years after the OECD privacy guidelines. http://www.oecd.org/sti/ieconomy/49710223.pdf. Accessed 28 Feb 2013.
Organization for the Advancement of Structured Information Standards (OASIS). 2013. eXtensible Access Control Markup Language (XACML) version 3.0 OASIS standard. http://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.pdf. Accessed 28 Feb 2013.
Park, Jaehong, and Ravi S. Sandhu. 2002. Towards usage control models: Beyond traditional access control. Proceedings of ACM symposium on access control models and technologies. New York: ACM.
Parliament of Canada. 2000. Personal information protection and electronic documents act.
Poullet, Yves. 2001. How to regulate Internet: new paradigms for Internet governance Self-regulation: value and limits. In Variations sur le droit de la soci ét é de l ’information, ed. Claire Monville, Cahiers du Centre de Recherches Informatique et Droit. 79–114. Bruxelles: Bruylant.
Raab, Charles. 2012. The meaning of ’accountability’ in the information privacy context.” In Managing privacy through accountability, ed. Daniel Guagnin et al., 15–32. Basingstoke: Palgrave Macmillan.
Reed, Chris. 2007. Taking sides on technology neutrality. SCRIPTed 263:263–284.
Schneider, Fred. 2009. Accountability for perfection. IEEE Security and Privacy Magazine 7:3–4.
Schneier, Bruce, and John Kelsey. 1999. Secure audit logs to support computer forensics. ACM Transactions on Information and System Security 2:159–176.
Title 12 of the United States Code. 1978. Right to Financial Privacy Act.
Trabelsi, Slim, Gregory Neven, and Dave Raggett. 2011. PrimeLife Deliverable D5.3.4: Report on design and implementation.
US Federal Trade Commission. 1973. Fair Information Practice Principles.
W3C. 2006. The platform for privacy preferences 1.1 (P3P1.1) specification. http://www.w3.org/TR/P3P11/. Accessed 28 Feb 2013.
Waters, Brent, Dirk Balfanz, Glenn Durfee, and Diana Smetters. 2004. Building an encrypted and searchable audit log. Proceedings of the network and distributed system security symposium. Reston: The Internet Society.
Wright, David, and Paul De Hert, ed. 2012. Privacy impact assessment. Berlin: Springer.
Wright, David, Raphaël Gellert, Serge Gutwirth, and Michael Friedewald. 2011. Minimizing technology risks with PIAs, precaution, and participation. IEEE Technology and Society Magazine 30:47–54.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2014 Springer Science+Business Media Dordrecht
About this chapter
Cite this chapter
Butin, D., Chicote, M., Le Métayer, D. (2014). Strong Accountability: Beyond Vague Promises. In: Gutwirth, S., Leenes, R., De Hert, P. (eds) Reloading Data Protection. Springer, Dordrecht. https://doi.org/10.1007/978-94-007-7540-4_16
Download citation
DOI: https://doi.org/10.1007/978-94-007-7540-4_16
Published:
Publisher Name: Springer, Dordrecht
Print ISBN: 978-94-007-7539-8
Online ISBN: 978-94-007-7540-4
eBook Packages: Humanities, Social Sciences and LawLaw and Criminology (R0)