Personal Data Protection: What are the challenges?
6 January 2009
Read by 1954 persons
Interview • Senator Alex Türk, President of the French National Commission for Information Technology and Liberties (CNIL)
We are interested in Morocco's presence in this system because we have common causes to defend.
The seminar on "Personal Data Protection: Challenges and Perspectives" launched a series of meetings between the Ministry of Industry, Trade, and New Technologies and various ministerial departments (Health, Justice, etc.). On the agenda: information system security, guaranteeing confidentiality of cross-border and national exchanges to ensure the protection of private data and fight cybercrime. Morocco adopted Law 09-08 on January 7th concerning the protection of individuals with regard to the processing of personal data.
The objective of this law, as Mr. Chami stated, is to provide the Moroccan legal framework with a legal instrument to protect individuals against data abuses that could harm their privacy, and to harmonize our personal data protection system with that of our partners, particularly European ones, as defined by European institutions." This change was necessary, particularly to attract foreign investment in areas like offshoring. Morocco aims to position itself as a secure destination for the circulation of personal data. All EU member states have data protection supervisory bodies.
To ensure compliance with these provisions, the law provides for the creation of the CNDP (National Commission for Data Protection), which will have broad powers of investigation, control, and intervention. Violators of the law face fines of up to 3,000,000 DH and prison sentences of up to two years. While awaiting the implementation of the law and the creation of the CNDP, the President of the CNIL, the French national commission for information technology and liberties, who led the seminar with the minister and the Secretary General of New Technologies, emphasizes the conditions for smooth operation: "the commission," he explains, "must first assert its independence, and it will have to do educational work, dialogue, and explanation."
The second challenge is the commission's legitimacy; it will take several months, even years, to establish itself in the Moroccan institutional landscape. This is crucial for its credibility, which will be reflected in its ability to perform various roles: legal counsel, educator (explaining citizens' rights, including their fundamental right to data protection), engineer (requiring high-level experts), controller (verifying law enforcement in institutions), and quasi-judge."
LE MATIN: Senator, you expressed a wish, a beautiful project, but for now, entirely virtual?
ALEX TÜRK: But achievable. Perhaps one day Morocco could host the World Conference on "Information and Liberty," and I would be delighted to return to Morocco. It would be an extraordinary event, as it would be the first time this conference is held outside Asia or the EU-27. It would be a way to broaden the scope of our efforts to protect freedoms.
Between this wish and the current reality, the distance is vast?
We are interested in Morocco's presence in this system because we have common causes to defend. And don't be mistaken, things are progressing. A year and a half ago, we reviewed the situation with Mr. Chami, and measures were taken. The text on the protection of individuals with regard to the processing of personal data resulted in Law 09-08, which was adopted quickly, surprising my European colleagues. Morocco is now engaged in the adequacy procedure with the EU.
What challenges will Morocco have to overcome?
The first challenge is independence. The national control commission to be set up must have a degree of independence.
Why a certain independence and not total independence?
Let's be realistic: no supervisory authority in the world is totally independent. It's more about institutional independence in accordance with regulations and laws in a democratic society. This means funding to support the commission's work, and collegiality from various executive and legislative backgrounds, essential for independence. Independence is a constant struggle, and the commission will have to assert its independence and undertake educational work, dialogue, and explanation, as we do daily in France. The second challenge is the commission's legitimacy; it will take several months, even years, to establish itself in the Moroccan institutional landscape.
New technologies are invading our professional lives, and tomorrow our private lives. Even if our connection rate is still very low, these technologies will enter all aspects of our lives. How will this commission act?
As IT gradually enters all sectors of society, the commission will do the same. It will play a crucial role as an advisor and watchdog for public authorities, addressing emerging societal issues driven by technological advancements leading to new industrial and commercial applications. The Moroccan national control commission will take positions on new issues, enabling parliament and the government to address societal matters. This will involve regular interactions between the commission, parliament, and the government.
As you mentioned in your speech, this implies strong citizen trust in the National Commission for the Control of Personal Data Protection (CNDP), whose creation is provided for in the adopted law?
Citizen trust is essential for a democratic society; it's a matter of freedom. The CNDP must inspire citizen confidence in the system and in the public authorities' approach to technological development. This trust is also essential for economic progress, as demonstrated at the recent world conference in Strasbourg. Supervisory bodies foster economic development because companies can develop technologies while respecting citizens, users, employees, and clients.
Personal data protection remains a difficult objective to achieve, even in democratizing countries. How many countries have such a system?
Those that respect citizens' rights. Few have taken the step of establishing such institutions. This represents 600 million citizens worldwide, only 10% of humanity, who have the right to data protection, which guarantees two essential freedoms underlying all freedoms: freedom of movement and freedom of expression. The right to personal data protection is the mechanism for upholding fundamental freedoms in this new technological civilization.
Can you elaborate on this idea?
Take freedom of movement: with the development of video surveillance, biometrics, geolocation of people and property, and the ability to locate individuals via mobile phones or bank cards, if we want to use technologies that improve daily life while preserving our fundamental freedom of movement, we need a personal data protection mechanism. If we want to use search engines and the internet to promote sharing, progress, and collective and individual enrichment while respecting our freedoms, personal data protection rules must be respected across the network. Otherwise, we will have to forgo their use and thus our freedom of expression. The 19th-century poet Baudelaire already claimed two fundamental rights in his personal life: the right to leave and the right to contradict himself—that is, to change, to evolve... What does this mean? That we shouldn't be judged years later by what we said at age 20, which might be contradictory. This is the right to be forgotten, to preserve freedom of expression. The personal data protection mechanism is, as you can see, fundamental.
What does the CNIL deal with concretely?
We handle many issues, such as the installation of biometrics by principals at the entrance to school cafeterias, monitoring maternity hospitals to prevent child abductions, doping in elite athletes, analysis of the third version of the controversial intelligence file, and discrimination. We are overwhelmed by companies wanting to install biometric entry systems using fingerprints, vein patterns in fingers or palms, or corneal scans... Video surveillance is also rapidly expanding. The time between technological innovation and the implementation of industrial and commercial applications is getting shorter. We are facing constantly accelerating technological progress and globalization. The CNIL must constantly alert the public authorities and sometimes accompany developments taken up by research organizations. We have advance knowledge of future developments, and our role is to keep watch and inform the public authorities.
There is also a need for this protection, as Mr. Chami pointed out, to develop trade, particularly within the digital economy, particularly offshoring?
We discussed this with the minister, as I was concerned about the considerable development of offshoring in Morocco within the framework of "Emergence," based on links between French and European companies and Moroccan companies. However, an equivalent level of protection was needed on both the French and European sides. Legally, the situation was vulnerable because exchanges were taking place outside the law. Hence the need to address this issue to secure the legal framework for our current cooperation. We need to do more, to forge a common approach to personal data protection to ensure all citizens have the same rights and freedoms.
Farida Moha
Published July 19, 2009
Posted online July 20, 2009
lematin.ma
We are interested in Morocco's presence in this system because we have common causes to defend.
The seminar on "Personal Data Protection: Challenges and Perspectives" launched a series of meetings between the Ministry of Industry, Trade, and New Technologies and various ministerial departments (Health, Justice, etc.). On the agenda: information system security, guaranteeing confidentiality of cross-border and national exchanges to ensure the protection of private data and fight cybercrime. Morocco adopted Law 09-08 on January 7th concerning the protection of individuals with regard to the processing of personal data.
The objective of this law, as Mr. Chami stated, is to provide the Moroccan legal framework with a legal instrument to protect individuals against data abuses that could harm their privacy, and to harmonize our personal data protection system with that of our partners, particularly European ones, as defined by European institutions." This change was necessary, particularly to attract foreign investment in areas like offshoring. Morocco aims to position itself as a secure destination for the circulation of personal data. All EU member states have data protection supervisory bodies.
To ensure compliance with these provisions, the law provides for the creation of the CNDP (National Commission for Data Protection), which will have broad powers of investigation, control, and intervention. Violators of the law face fines of up to 3,000,000 DH and prison sentences of up to two years. While awaiting the implementation of the law and the creation of the CNDP, the President of the CNIL, the French national commission for information technology and liberties, who led the seminar with the minister and the Secretary General of New Technologies, emphasizes the conditions for smooth operation: "the commission," he explains, "must first assert its independence, and it will have to do educational work, dialogue, and explanation."
The second challenge is the commission's legitimacy; it will take several months, even years, to establish itself in the Moroccan institutional landscape. This is crucial for its credibility, which will be reflected in its ability to perform various roles: legal counsel, educator (explaining citizens' rights, including their fundamental right to data protection), engineer (requiring high-level experts), controller (verifying law enforcement in institutions), and quasi-judge."
LE MATIN: Senator, you expressed a wish, a beautiful project, but for now, entirely virtual?
ALEX TÜRK: But achievable. Perhaps one day Morocco could host the World Conference on "Information and Liberty," and I would be delighted to return to Morocco. It would be an extraordinary event, as it would be the first time this conference is held outside Asia or the EU-27. It would be a way to broaden the scope of our efforts to protect freedoms.
Between this wish and the current reality, the distance is vast?
We are interested in Morocco's presence in this system because we have common causes to defend. And don't be mistaken, things are progressing. A year and a half ago, we reviewed the situation with Mr. Chami, and measures were taken. The text on the protection of individuals with regard to the processing of personal data resulted in Law 09-08, which was adopted quickly, surprising my European colleagues. Morocco is now engaged in the adequacy procedure with the EU.
What challenges will Morocco have to overcome?
The first challenge is independence. The national control commission to be set up must have a degree of independence.
Why a certain independence and not total independence?
Let's be realistic: no supervisory authority in the world is totally independent. It's more about institutional independence in accordance with regulations and laws in a democratic society. This means funding to support the commission's work, and collegiality from various executive and legislative backgrounds, essential for independence. Independence is a constant struggle, and the commission will have to assert its independence and undertake educational work, dialogue, and explanation, as we do daily in France. The second challenge is the commission's legitimacy; it will take several months, even years, to establish itself in the Moroccan institutional landscape.
New technologies are invading our professional lives, and tomorrow our private lives. Even if our connection rate is still very low, these technologies will enter all aspects of our lives. How will this commission act?
As IT gradually enters all sectors of society, the commission will do the same. It will play a crucial role as an advisor and watchdog for public authorities, addressing emerging societal issues driven by technological advancements leading to new industrial and commercial applications. The Moroccan national control commission will take positions on new issues, enabling parliament and the government to address societal matters. This will involve regular interactions between the commission, parliament, and the government.
As you mentioned in your speech, this implies strong citizen trust in the National Commission for the Control of Personal Data Protection (CNDP), whose creation is provided for in the adopted law?
Citizen trust is essential for a democratic society; it's a matter of freedom. The CNDP must inspire citizen confidence in the system and in the public authorities' approach to technological development. This trust is also essential for economic progress, as demonstrated at the recent world conference in Strasbourg. Supervisory bodies foster economic development because companies can develop technologies while respecting citizens, users, employees, and clients.
Personal data protection remains a difficult objective to achieve, even in democratizing countries. How many countries have such a system?
Those that respect citizens' rights. Few have taken the step of establishing such institutions. This represents 600 million citizens worldwide, only 10% of humanity, who have the right to data protection, which guarantees two essential freedoms underlying all freedoms: freedom of movement and freedom of expression. The right to personal data protection is the mechanism for upholding fundamental freedoms in this new technological civilization.
Can you elaborate on this idea?
Take freedom of movement: with the development of video surveillance, biometrics, geolocation of people and property, and the ability to locate individuals via mobile phones or bank cards, if we want to use technologies that improve daily life while preserving our fundamental freedom of movement, we need a personal data protection mechanism. If we want to use search engines and the internet to promote sharing, progress, and collective and individual enrichment while respecting our freedoms, personal data protection rules must be respected across the network. Otherwise, we will have to forgo their use and thus our freedom of expression. The 19th-century poet Baudelaire already claimed two fundamental rights in his personal life: the right to leave and the right to contradict himself—that is, to change, to evolve... What does this mean? That we shouldn't be judged years later by what we said at age 20, which might be contradictory. This is the right to be forgotten, to preserve freedom of expression. The personal data protection mechanism is, as you can see, fundamental.
What does the CNIL deal with concretely?
We handle many issues, such as the installation of biometrics by principals at the entrance to school cafeterias, monitoring maternity hospitals to prevent child abductions, doping in elite athletes, analysis of the third version of the controversial intelligence file, and discrimination. We are overwhelmed by companies wanting to install biometric entry systems using fingerprints, vein patterns in fingers or palms, or corneal scans... Video surveillance is also rapidly expanding. The time between technological innovation and the implementation of industrial and commercial applications is getting shorter. We are facing constantly accelerating technological progress and globalization. The CNIL must constantly alert the public authorities and sometimes accompany developments taken up by research organizations. We have advance knowledge of future developments, and our role is to keep watch and inform the public authorities.
There is also a need for this protection, as Mr. Chami pointed out, to develop trade, particularly within the digital economy, particularly offshoring?
We discussed this with the minister, as I was concerned about the considerable development of offshoring in Morocco within the framework of "Emergence," based on links between French and European companies and Moroccan companies. However, an equivalent level of protection was needed on both the French and European sides. Legally, the situation was vulnerable because exchanges were taking place outside the law. Hence the need to address this issue to secure the legal framework for our current cooperation. We need to do more, to forge a common approach to personal data protection to ensure all citizens have the same rights and freedoms.
Farida Moha
Published July 19, 2009
Posted online July 20, 2009
lematin.ma
