Today is European Data Protection Day. This day was established around twenty years ago to inform citizens about their rights. It also serves as a reminder to organizations to improve their data protection. The police are taking this opportunity to discuss privacy and our actions in accordance with the rule of law.
Hamit Karakus, portfolio holder for Privacy and Ethics at the police, and Vincent Böhre, director of the Privacy First foundation, consider the question of when the use of data is proportionate. Where are the limits and how can we protect personal data in such a way that legislation remains enforceable and innovation is given more scope?
"I've noticed that people often talk about a conflict between privacy and security," Böhre begins. "But in my view, there is no conflict at all. In fact, I believe that privacy and security go hand in hand. If we look at the right to physical integrity, which also falls under privacy, then in my opinion the worst privacy violations are not the cookies on your computer. Burglaries, assaults, threats, and kidnappings have a much greater impact on a person's life. Sometimes, infringing on someone's privacy is necessary in order to protect a larger group of people. At Privacy First, we are therefore absolutely in favor of the best possible investigation and prosecution."
"But," he immediately adds, "with the best possible privacy safeguards. And I think that's exactly where the challenge lies. Finding the balance between protection and workability, and between trust and progress."
Karakus: "It's great that you're approaching privacy in this way. It is also the primary task of the police to tackle crime and protect safety in our society. At the same time, I don't think anyone can be in favor of unnecessarily violating someone's privacy. Take camera images and personal data, for example, which are entrusted to us. We handle these with care. I always compare the use of data to the use of our means of force. We determine how and when we use these means on the basis of an assessment framework.'
Society is always an important factor in our consideration of interests. This can sometimes cause friction. In the case of privacy, on the one hand, people want us to protect and respect the privacy of individuals, and on the other hand, we are expected to track down criminals and prevent serious incidents.
"This does not alter the fact that we must ask ourselves in advance whether the use of certain data is justified in view of the goal we want to achieve and that we must properly justify the use of data afterwards," Karakus emphasizes. "Just as we do when using force. For example, with an independent commission that assesses whether the use of CCTV surveillance or facial recognition, for example, has been proportionate. If we can clearly explain in which situations we use which data, this will create more confidence in the rule of law."
Böhre: ‘I agree, but what I would like to warn the police about is that the exception should not become the rule. An organization with a lot of powers must be subject to rigorous scrutiny. In other words, with power comes responsibility. If you can demonstrate that you are doing this, then you will indeed retain the support and trust of society.’
"I also hope that the police will continue to be mindful of the tension between these two areas," Böhre continues. "Collecting, using, and storing data may serve security purposes, but it also conflicts with people's fundamental freedoms. A solution I would recommend to the entire government is to make much greater use of privacy by design. This involves integrating privacy and data protection into products, services, and systems right from the design phase. In the case of camera surveillance, this could include privacy-enhancing techniques such as automatically anonymizing passers-by by blurring their faces. However, this requires a culture in which legal protection is taken extremely seriously."
"That intention is certainly there," Karakus emphasizes. "Nevertheless, I expect that we will not always be able to keep up with all technological developments. Given the complexity, we should ensure that privacy projects continue to be given priority. Another sensitive issue is regulation. We know that a lot is possible technologically, but the question is how we are going to organize the implementation of new products, services, and systems. Is there sufficient scope for innovation and experimentation within the current legislation and regulations?"
Böhre acknowledges the slow and obstructive nature of privacy legislation. "Nevertheless, with a view to fighting crime, the police should remain closely involved in current developments. A topical issue that, in my opinion, deserves much more attention is digital sovereignty. For an organization such as the police, I think it is important to retain control over its own data, digital infrastructure, and technology, independent of foreign influences. As a police force, I think you want to decide for yourself where data is stored, who has access to it, and which legislation applies."
"It is very valuable when organizations such as Privacy First hold up a mirror to us during these important developments," Karakus emphasizes. "We need that sharp outside perspective. Of course, we cannot agree on everything, and our opinions will sometimes clash, but cooperation and partnership strengthen our professional expertise."
The relationship between the two organizations has been good for years. "Privacy First has inspiring and informative discussions with the police leadership every year," says Böhre. "Nevertheless, there are still plenty of wishes for the future. As an independent foundation, Privacy First will always strive for as much democratic control as possible over the police's data power."
